boost-skill-cli 1.2.143__tar.gz → 1.2.145__tar.gz

{boost_skill_cli-1.2.143 → boost_skill_cli-1.2.145}/.vale/styles/config/vocabularies/boost/accept.txt

@@ -70,6 +70,7 @@ GTM
 gzip
 gzipped
 hardcode
+hardcoded
 Helm
 hotspots
 Huashu
@@ -148,9 +149,11 @@ setuptools
 SHAs
 Shopify
 Sigstore
+snake_case
 Snyk
 SonarCloud
 stderr
+stdin
 Stdlib
 stdlib
 stdout

{boost_skill_cli-1.2.143 → boost_skill_cli-1.2.145}/CLAUDE.md

@@ -541,10 +541,10 @@ nothing. Consequences for code you write:
     finer than `skills_only` can express (which would drop rules too), so the
     `workflows` flag exists and `agents.workflow_agents()` is the set that
     honours it. `~/.codex/rules/*.rules` is the `execpolicy` command-approval
-    DSL, not an instructions dir — don't write there. Its MCP and hooks hosts
-    are not wired up: the MCP grammar is verified but unimplemented, and the
-    hook `timeout` units are unestablished, so this file records neither as
-    done.
+    DSL, not an instructions dir — don't write there. Its **MCP host is wired
+    up** (`core/mcphost.py`, fourth row — see below) and so is its **hooks**
+    host (`core/hookhost.py`, third row — the `timeout` units this file used
+    to record as unestablished are **seconds**, measured; see below).
   - **Its dir is the one agent path that is not fixed**, hence the
     `${CODEX_HOME:-~/.codex}/skills` default and `paths.expand`'s leading
     `${VAR:-fallback}` syntax. Only a *leading* reference expands and nesting
@@ -599,7 +599,8 @@ nothing. Consequences for code you write:
   `agents/` slot stays verbatim Markdown. Getting that backwards produces a file
   the agent silently never loads.
 - `core/mcphost.py` holds the per-host `mcp add`/`remove` grammar.
-  **Antigravity CLI (`agy`) is the third host**, and one argv rule of its own
+  **Antigravity CLI (`agy`) is the third host and Codex CLI is the fourth**,
+  and one argv rule of agy's own
   bites: flags must come *before* `<name>` (a flag after it is rejected). The
   `--` boost also emits is agy's documented separator and, measured on 1.1.22,
   inert — agy never consumes an argument that *follows* the command, and
@@ -609,7 +610,34 @@ nothing. Consequences for code you write:
   `has_scope()` exists and the success line drops "(scope: user)" for it. Its
   `add` **upserts** where Claude's errors on a duplicate name; that asymmetry
   is what made `--host auto` abort on a machine already registered with
-  Claude. Claude and
+  Claude.
+
+  **Codex agrees with none of the other three outright, and the difference
+  with teeth is the flag spelling**: `--env` is long-form only — `codex mcp
+  add x -e A=1 -- cmd` exits 2 with "unexpected argument `-e` found", and its
+  own tip ("to pass `-e` as a value, use `-- -e`") is about the command, not
+  the option. So the env flag is a per-host spelling (`mcphost.ENV_FLAG`, an
+  override table whose absent rows mean `-e`) rather than one constant. It
+  takes flags on *either* side of the name (agy rejects one after it), puts
+  `--` on Claude's side, and there it is load-bearing rather than decorative:
+  with it a dash-leading command is stored verbatim, where agy rejects the
+  same input. Like agy it has **no scope** (one global
+  `$CODEX_HOME/config.toml`) and its `add` upserts. Two things about *where*
+  it writes are its own, and both are in `config_home`: the default home is
+  **`$HOME/.codex`, a subdirectory** where the other three are rooted at
+  `$HOME` itself (`CONFIG_HOME_DEFAULT_REL`), and a **relative `CODEX_HOME`
+  is honoured against the current directory** (`RELATIVE_CONFIG_HOME_CWD`) —
+  the exact opposite of Claude Code, which refuses a relative
+  `CLAUDE_CONFIG_DIR` outright. That last one is why they cannot share a
+  branch: Claude's "relative → fall back to `$HOME`" would have reported a
+  write contained when it lands wherever the user happened to be standing.
+  One more asymmetry is on the removal side: `codex mcp remove <missing>`
+  prints `No MCP server named 'boost' found.` and exits **0**, which contains
+  "found" but never "not found", so `_NOT_REGISTERED` carries a second marker
+  or `classify_result` reports a removal that never happened. All measured
+  against codex-cli 0.156.1 on 2026-09-27.
+
+  Claude and
   Gemini disagree on name position, the `--` separator, and whether unregister
   needs an explicit scope — all three verified against the real CLIs and pinned
   by `tests/unit/test_mcphost.py`. **boost emits the separator for all three,
@@ -626,7 +654,7 @@ nothing. Consequences for code you write:
   in a spec's args rewrites the entry as `{"url": "npx", "type": "http"}`. Emit
   the separator unconditionally: `add x npx --` is accepted and stores
   `args: []`. Don't "simplify" them into one shape —
-  **one function, three branches**, which is what `mcphost.add_argv` is. It is
+  **one function, four branches**, which is what `mcphost.add_argv` is. It is
   the only copy of the `mcp add` grammar, and it is the only copy because
   `mcpdecl.register_argv` (the install path, registering a server a *skill*
   declares) used to be a second one: it had a Gemini branch and a Claude
@@ -639,14 +667,14 @@ nothing. Consequences for code you write:
   no-op against a user-scope entry, and Claude, which needs none, is handed one
   so the argv cannot reach `<cwd>/.mcp.json`, the one scope outside every
   `$HOME` and so the one `mcphost.escapes_home` cannot judge.
-- **`core/hookhost.py` is the same idea for hooks, and two hosts have them.**
+- **`core/hookhost.py` is the same idea for hooks, and three hosts have them.**
   `boost hooks` writes Claude Code's `~/.claude/settings.json` (the default,
-  unchanged) or, behind `--host gemini`, the `~/.gemini/settings.json` that
-  Gemini CLI reads;
+  unchanged), or behind `--host` the `~/.gemini/settings.json` that Gemini CLI
+  reads or the `$CODEX_HOME/hooks.json` that Codex CLI reads;
   `core/claude_settings.py` takes `host=` throughout and asks the table for the
   differences. The `hooks` key and the `{matcher, hooks: [{type, command,
-  timeout}]}` block shape are *identical* between them, which is exactly what
-  makes the three real differences easy to ship wrong:
+  timeout}]}` block shape are *identical* across all three, which is exactly
+  what makes the real differences easy to ship wrong. Gemini's three:
   - **`timeout` units.** Claude's is **seconds**; Gemini's is **milliseconds**
     (`DEFAULT_HOOK_TIMEOUT = 6e4`, fed straight to `setTimeout`). Callers pass
     seconds and `hookhost.hook_entry` converts, so boost's `--timeout 10` is ten
@@ -673,6 +701,73 @@ nothing. Consequences for code you write:
   sources are named at the top of `hookhost.py` so the next person can re-check
   them against a newer release.
 
+  **Codex's four are different differences, and two of them are not about the
+  block at all.** Measured against Codex CLI 0.156.1 on 2026-09-27, from four
+  sources named at the top of `hookhost.py` (`codex app-server
+  generate-json-schema`; `strings` over the binary the ChatGPT app ships;
+  observed `codex app-server` `hooks/list` runs; the 23 embedded draft-07
+  schemas its `schema_loader.rs` reads):
+  - **The filename is `hooks.json`**, not `settings.json` — the only host
+    where it is not, hence `hookhost.settings_file`. A `hooks` key in a
+    `settings.json` is a file Codex never opens, and nothing says so.
+  - **The user root moves.** `$CODEX_HOME` relocates it and a *relative* value
+    is honoured against the current directory — the measured grammar lives
+    once, in `mcphost.config_home`. The **project** root does not move: it is
+    the literal `<project>/.codex` whatever `CODEX_HOME` says. Because the
+    variable is ambient, `claude_settings.escaping_path` refuses a user-scope
+    write that lands outside this `$HOME` unless `--force` comes with it —
+    the same hole `test_mcp_install_sandbox_home.py` closes for `mcp add`,
+    where a sandboxed `HOME` does not move `CODEX_HOME` and a test run wrote
+    into the developer's live `~/.codex`. The sweeps in `commands/bmad.py`
+    **skip** such a host with a warning rather than inheriting the refusal:
+    an aborted `bmad on` would leave Claude without its hooks either. So
+    `boost bmad` carries its own `--force`, and needs to: `bmad doctor` reads
+    the relocated file and reports the hook that will actually run, and
+    without the flag no `bmad` command could act on what `doctor` had just
+    reported. `_autopilot_on` resolves its host list **before** writing the
+    personas, because that resolution is the only step that can refuse and
+    refusing after `write_personas` left files on disk that
+    `_set_scope_state` never recorded.
+  - **`timeout` is in seconds**, agreeing with Claude and not Gemini. (Also
+    measured: `timeoutSec` is the *wire* spelling only — as a config key it is
+    ignored and the hook silently falls back to Codex's 600-second default.)
+  - **Event names are matched exactly, and an unknown one is dropped in
+    silence.** Twelve PascalCase events; `NotARealEvent` and `sessionstart`
+    each produced no hook, no warning and no error. So Codex is
+    `strict_events` in the table and `translate` returns `None` rather than
+    taking Gemini's warn-but-add fallthrough — the "looks installed and never
+    fires" failure this module exists to prevent. `CLAUDE_TO_CODEX` maps all
+    ten Claude events explicitly; only `Notification` has no counterpart
+    (Codex *has* both sub-agent events, which is why the refusal's "has no
+    sub-agents" clause is now a per-host `no_counterpart_note` rather than one
+    hardcoded sentence).
+
+  Two more Codex facts shape the writer rather than the block. A hook's trust
+  key is positional — `<sourcePath>:<event>:<group_index>:<handler_index>` —
+  so a re-add that drops a group and appends a new one re-keys every group
+  after it and voids the user's trust grant on each (measured: an untouched
+  neighbour moved `:0:0` -> `:1:0`). `add_hook` therefore **replaces in
+  place**, for every host: shuffling a file boost does not own was never a
+  feature, only never load-bearing. And a new hook does not run until the user
+  trusts it at startup, with project scope also needing `trust_level =
+  "trusted"` — `commands/hooks.py` says so after a Codex add, because "added"
+  alone is true and useless.
+
+  **Hook stdin and stdout are schema-validated, and both schemas were read
+  rather than assumed.** Every event has an embedded pair,
+  `<event>.command.{input,output}`, each `"additionalProperties": false`. The
+  output side carries `hookSpecificOutput` -> `<Event>HookSpecificOutputWire`
+  with `additionalContext` and a required `hookEventName` pinned to that
+  event's PascalCase `const`, so `hookhost.context_output`'s Gemini-shaped
+  JSON is what Codex wants too — Claude's plain-text `SessionStart` shortcut
+  is the one thing that does not carry over. The input side uses Claude's
+  snake_case keys (`prompt`, `session_id`, `cwd`, `hook_event_name`) plus
+  Codex's own `model`/`permission_mode`/`turn_id`, so `bmad._read_hook_stdin`
+  needs no per-host branch. Both were worth measuring rather than inferring:
+  `_host_command` ends every non-Claude hook in `2>/dev/null || true`, so a
+  key spelled wrong on either side is a router that prints nothing, on every
+  prompt, with no error anywhere.
+
 `core/catalog.scan_dir` walks a tap's clone and classifies each file into one
 of the three item kinds (see Non-obvious rules above); `core/store.py` owns
 install, uninstall and sync — copying into the canonical store, symlinking into

{boost_skill_cli-1.2.143 → boost_skill_cli-1.2.145}/CONTRIBUTING.md

@@ -121,7 +121,7 @@ list, and neither should be added to it.
 | `make test` | unit + functional suites, **≥90% coverage** (statements + branches) |
 | `make patch-coverage` | changed-line coverage vs `main`, **≥80% of the diff** (PRs) |
 | `bash tests/smoke.sh` | 183 end-to-end checks through the real `./boost` shim |
-| `make bdd` | the Gherkin suite — 11 features, 56 scenarios (needs the `[bdd]` extra) |
+| `make bdd` | the Gherkin suite — 11 features, 57 scenarios (needs the `[bdd]` extra) |
 | `make mutation` | mutmut over `boost_cli/core`, **≥80% mutants killed** |
 | `ruff check boost_cli tests` | lint, zero findings |
 | `mypy` | type check, zero errors |

{boost_skill_cli-1.2.143 → boost_skill_cli-1.2.145}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.2.143
+Version: 1.2.145
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License-Expression: Apache-2.0
@@ -63,7 +63,8 @@ Antigravity CLI (`agy`) is wired up the same way: skills link into
 Codex — the `codex` CLI and the ChatGPT desktop app, which is the same binary —
 needs no symlink at all: `~/.agents/skills` is one of its own skill roots, so a
 skill boost copies into the canonical store is already there. Rules materialize
-into `~/.codex/AGENTS.md`.
+into `~/.codex/AGENTS.md`, and `boost mcp register` reaches it through
+`codex mcp add`.
 
 ```bash
 pipx install boost-skill-cli
@@ -512,6 +513,7 @@ purely local operation, for CI images and air-gapped machines.
 | Claude Code | `claude` | `claude mcp add` → its user-scope MCP config |
 | Gemini CLI | `gemini` | `gemini mcp add -s user` → `~/.gemini/settings.json` |
 | Antigravity CLI | `agy` | `agy mcp add` → `~/.gemini/config/mcp_config.json` |
+| Codex CLI | `codex` | `codex mcp add` → `${CODEX_HOME:-~/.codex}/config.toml` |
 
 Seven tools are exposed: `boost_search`, `boost_list`, `boost_info`,
 `boost_read`, `boost_install`, `boost_doctor` and
@@ -519,25 +521,27 @@ Seven tools are exposed: `boost_search`, `boost_list`, `boost_info`,
 actual text — without it, installing was the only way to read a skill.
 
 The server also returns MCP `instructions`, telling the agent when boost is
-relevant. The two hosts place those differently, and it matters. Claude Code
-loads them into the system prompt. Gemini CLI appends them to its memory tier
-alongside `GEMINI.md`, and only in a trusted folder, so outside one they are
-dropped silently. Each tool's own description therefore repeats its trigger,
-because a tool description is the only part always in context at the moment the
-agent chooses a tool.
+relevant. Claude Code and Gemini CLI place those differently, and it matters.
+Claude Code loads them into the system prompt. Gemini CLI appends them to its
+memory tier alongside `GEMINI.md`, and only in a trusted folder, so outside one
+they are dropped silently. Each tool's own description therefore repeats its
+trigger, because a tool description is the only part always in context at the
+moment the agent chooses a tool.
 
-Verify with `claude mcp list` or `gemini mcp list`; boost should show as
-Connected.
+Verify with `claude mcp list`, `gemini mcp list` or `codex mcp list`; boost
+should show as Connected.
 
 ## Agent hooks and BMAD
 
-`boost hooks` manages hooks in `settings.json` for Claude Code and Gemini CLI,
+`boost hooks` manages hooks for Claude Code, Gemini CLI and Codex CLI —
+`settings.json` for the first two, `$CODEX_HOME/hooks.json` for Codex —
 translating between their event vocabularies and timeout units. `boost bmad on`
 uses them to put the BMAD Method's personas in charge of every task, in one
 command with no Node and no network.
 
 ```bash
 boost hooks add SessionStart -c 'echo hello' -n greet --scope project
+boost hooks add SessionStart --host codex -c 'echo hello' -n greet
 boost bmad on
 ```
 

{boost_skill_cli-1.2.143 → boost_skill_cli-1.2.145}/README.md

@@ -21,7 +21,8 @@ Antigravity CLI (`agy`) is wired up the same way: skills link into
 Codex — the `codex` CLI and the ChatGPT desktop app, which is the same binary —
 needs no symlink at all: `~/.agents/skills` is one of its own skill roots, so a
 skill boost copies into the canonical store is already there. Rules materialize
-into `~/.codex/AGENTS.md`.
+into `~/.codex/AGENTS.md`, and `boost mcp register` reaches it through
+`codex mcp add`.
 
 ```bash
 pipx install boost-skill-cli
@@ -470,6 +471,7 @@ purely local operation, for CI images and air-gapped machines.
 | Claude Code | `claude` | `claude mcp add` → its user-scope MCP config |
 | Gemini CLI | `gemini` | `gemini mcp add -s user` → `~/.gemini/settings.json` |
 | Antigravity CLI | `agy` | `agy mcp add` → `~/.gemini/config/mcp_config.json` |
+| Codex CLI | `codex` | `codex mcp add` → `${CODEX_HOME:-~/.codex}/config.toml` |
 
 Seven tools are exposed: `boost_search`, `boost_list`, `boost_info`,
 `boost_read`, `boost_install`, `boost_doctor` and
@@ -477,25 +479,27 @@ Seven tools are exposed: `boost_search`, `boost_list`, `boost_info`,
 actual text — without it, installing was the only way to read a skill.
 
 The server also returns MCP `instructions`, telling the agent when boost is
-relevant. The two hosts place those differently, and it matters. Claude Code
-loads them into the system prompt. Gemini CLI appends them to its memory tier
-alongside `GEMINI.md`, and only in a trusted folder, so outside one they are
-dropped silently. Each tool's own description therefore repeats its trigger,
-because a tool description is the only part always in context at the moment the
-agent chooses a tool.
+relevant. Claude Code and Gemini CLI place those differently, and it matters.
+Claude Code loads them into the system prompt. Gemini CLI appends them to its
+memory tier alongside `GEMINI.md`, and only in a trusted folder, so outside one
+they are dropped silently. Each tool's own description therefore repeats its
+trigger, because a tool description is the only part always in context at the
+moment the agent chooses a tool.
 
-Verify with `claude mcp list` or `gemini mcp list`; boost should show as
-Connected.
+Verify with `claude mcp list`, `gemini mcp list` or `codex mcp list`; boost
+should show as Connected.
 
 ## Agent hooks and BMAD
 
-`boost hooks` manages hooks in `settings.json` for Claude Code and Gemini CLI,
+`boost hooks` manages hooks for Claude Code, Gemini CLI and Codex CLI —
+`settings.json` for the first two, `$CODEX_HOME/hooks.json` for Codex —
 translating between their event vocabularies and timeout units. `boost bmad on`
 uses them to put the BMAD Method's personas in charge of every task, in one
 command with no Node and no network.
 
 ```bash
 boost hooks add SessionStart -c 'echo hello' -n greet --scope project
+boost hooks add SessionStart --host codex -c 'echo hello' -n greet
 boost bmad on
 ```
 

{boost_skill_cli-1.2.143 → boost_skill_cli-1.2.145}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.2.143'
-__version_tuple__ = version_tuple = (1, 2, 143)
+__version__ = version = '1.2.145'
+__version_tuple__ = version_tuple = (1, 2, 145)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.2.143 → boost_skill_cli-1.2.145}/boost_cli/cli.py

@@ -128,8 +128,8 @@ COMMANDS = [
     ("completions", "cfg", "configuration", "Generate shell tab-completion scripts"),
     ("schedule",    "cfg", "configuration", "Manage automatic skill-sync scheduling"),
     ("serve",       "cfg", "configuration", "Browse the catalogue in a browser: search, facets and a tap graph"),
-    ("mcp",         "cfg", "configuration", "Register boost as an MCP server (Claude Code, Gemini CLI, Antigravity CLI)"),
-    ("hooks",       "cfg", "hooks", "Manage agent hooks (Claude Code, Gemini CLI) in settings.json"),
+    ("mcp",         "cfg", "configuration", "Register boost as an MCP server (Claude Code, Gemini CLI, Antigravity CLI, Codex CLI)"),
+    ("hooks",       "cfg", "hooks", "Manage agent hooks (Claude Code, Gemini CLI, Codex CLI)"),
     ("bmad",        "cfg", "bmad", "BMAD Method autopilot — `bmad on` routes every task to a persona"),
     ("self-update", "cfg", "configuration", "Update boost itself to the latest version"),
     # Team & Collaboration (6)

{boost_skill_cli-1.2.143 → boost_skill_cli-1.2.145}/boost_cli/commands/bmad.py

@@ -113,6 +113,10 @@ def cmd_bmad(argv) -> int:
                    help="enable the startup toggle right after install")
     p.add_argument("--plain", action="store_true",
                    help="route: print the banner as text, not as hook JSON")
+    p.add_argument("--force", action="store_true",
+                   help="reach hosts whose settings file lies outside this "
+                        "$HOME (a relocated $CODEX_HOME), which on/off/"
+                        "startup/uninstall/disable otherwise skip")
     p.add_argument("--host", metavar="H", default=None,
                    choices=(*hookhost.hosts(), "auto"),
                    help="on/startup: hosts to hook (%s; default auto: "
@@ -121,9 +125,9 @@ def cmd_bmad(argv) -> int:
     args = p.parse_args(argv)
 
     if args.action == "on":
-        return _autopilot_on(args.scope, args.host)
+        return _autopilot_on(args.scope, args.host, args.force)
     if args.action == "off":
-        return _autopilot_off(args.scope)
+        return _autopilot_off(args.scope, args.force)
     if args.action == "route":
         return _route(args.value, args.plain, args.scope, _one_host(args.host))
     if args.action == "personas":
@@ -133,13 +137,14 @@ def cmd_bmad(argv) -> int:
     if args.action == "init":
         return _init(args.modules, args.startup)
     if args.action == "startup":
-        return _startup(args.value or "status", args.scope, args.host)
+        return _startup(args.value or "status", args.scope, args.host,
+                        args.force)
     if args.action == "orient":
         return _orient(args.scope, _one_host(args.host))
     if args.action == "uninstall":
-        return _uninstall(args.scope, args.yes)
+        return _uninstall(args.scope, args.yes, args.force)
     if args.action == "disable":
-        return _disable(args.scope)
+        return _disable(args.scope, args.force)
     if args.action == "enable":
         return _enable(args.scope)
     return _doctor()  # doctor | status
@@ -187,7 +192,7 @@ def _one_host(host) -> str:
     return hookhost.CLAUDE if host in (None, "auto") else host
 
 
-def _hook_hosts(scope: str, requested=None) -> list[str]:
+def _hook_hosts(scope: str, requested=None, force: bool = False) -> list[str]:
     """Hosts to write hooks into: Claude always, others on evidence of use.
 
     Claude is unconditional. It is boost's primary host and the behaviour every
@@ -205,20 +210,55 @@ def _hook_hosts(scope: str, requested=None) -> list[str]:
 
     ``requested`` (`--host`) overrides the rule: naming one host writes that
     host only, so Claude-only no longer means hand-editing Gemini's settings
-    after every `on`.
+    after every `on`. It does **not** override the escape guard — naming a
+    host whose file lies outside this `$HOME` raises here, before the caller
+    has written anything, rather than from `add_hook` half a command later.
+    `--force` is what gets past it, on either path.
+
+    Resolved once per command and passed around, not recomputed per hook:
+    `on` installs two hooks, and a host list that decided itself twice said
+    "skipping Codex CLI" twice for one decision.
     """
     if requested not in (None, "auto"):
-        return [requested]
+        cs.refuse_escape(scope, str(requested), force=force)
+        return [str(requested)]
     chosen = [hookhost.CLAUDE]
     for host in hookhost.hosts():
         if host == hookhost.CLAUDE:
             continue
         dotdir = cs.settings_path(scope, host=host).parent
-        if shutil.which(hookhost.cli(host)) or dotdir.is_dir():
-            chosen.append(host)
+        if not (shutil.which(hookhost.cli(host)) or dotdir.is_dir()):
+            continue
+        # After the evidence check: warning about a host that was never a
+        # candidate is noise, and it is the only thing this warning is for.
+        if _skip_escaping(scope, host, force):
+            continue
+        chosen.append(host)
     return chosen
 
 
+def _skip_escaping(scope: str, host: str, force: bool = False) -> bool:
+    """True — and says so — when `host`'s file lies outside this `$HOME`.
+
+    `bmad on`/`off` sweep every host they find, so one host boost must not
+    write is a reason to leave that host alone, not to abort the sweep: an
+    unguarded `add_hook` raises and Claude's hook never gets installed either.
+
+    The deliberate case is `--force`, on `bmad` itself and not only on `boost
+    hooks`. Without it here, `bmad doctor` could report a hook in a relocated
+    `$CODEX_HOME` — it reads what will actually run — that `bmad off` then
+    refused to remove, with nothing in the command able to reconcile the two.
+    """
+    if force:
+        return False
+    target = cs.escaping_path(scope, host)
+    if target is None:
+        return False
+    out.warn("skipping %s — %s is outside this $HOME"
+             % (hookhost.label(host), target), wrap=True)
+    return True
+
+
 #: (Claude event, hook name, matcher). The matcher is Claude's own
 #: `SessionStart` source vocabulary, and `hookhost` deliberately does not
 #: translate matchers — they pass through host-native — so it is applied only
@@ -243,11 +283,16 @@ def _host_command(host: str, command: str) -> str:
 
 
 def _add_hook_everywhere(scope: str, spec: tuple, command: str,
-                         requested=None) -> list[str]:
-    """Install one hook on every chosen host. Returns the hosts written."""
+                         hosts: list[str], force: bool = False) -> list[str]:
+    """Install one hook on each of `hosts`. Returns the ones written.
+
+    Takes the list rather than resolving it, because resolving it is where
+    the escape guard and its warning live and a caller installing two hooks
+    must make that decision once.
+    """
     event, name, matcher = spec
     written = []
-    for host in _hook_hosts(scope, requested):
+    for host in hosts:
         target = hookhost.translate(host, event)
         if target is None:
             # Refused out loud rather than dropped: a hook the user asked for
@@ -257,12 +302,13 @@ def _add_hook_everywhere(scope: str, spec: tuple, command: str,
             continue
         cs.add_hook(scope, target, name, _host_command(host, command),
                     matcher=matcher if host == hookhost.CLAUDE else None,
-                    host=host)
+                    host=host, force=force)
         written.append(host)
     return written
 
 
-def _remove_hook_everywhere(scope: str, *specs: tuple) -> int:
+def _remove_hook_everywhere(scope: str, *specs: tuple,
+                            force: bool = False) -> int:
     """Remove hooks from every host, installed or not. Returns how many were.
 
     Unlike install this does not filter on `shutil.which`: someone who removed
@@ -273,21 +319,30 @@ def _remove_hook_everywhere(scope: str, *specs: tuple) -> int:
     """
     removed = 0
     for host in hookhost.hosts():
+        if _skip_escaping(scope, host, force):
+            continue
         for event, name, _matcher in specs:
             target = hookhost.translate(host, event)
             if target is not None:
-                removed += cs.remove_hook(scope, target, name, host=host)
+                removed += cs.remove_hook(scope, target, name, host=host,
+                                          force=force)
     return removed
 
 
-def _autopilot_on(scope, requested_host=None) -> int:
+def _autopilot_on(scope, requested_host=None, force: bool = False) -> int:
     """The one command. Personas + orientation + router, in one idempotent pass.
 
     Global by default: the point of the autopilot is that a task arriving in
     *any* repo already knows which persona owns it, and per-project setup would
     make that a per-repo chore.
+
+    The host list is resolved **first**, before anything is written. It is the
+    only step that can refuse — a `--host` whose settings file lies outside
+    this `$HOME` — and refusing after `write_personas` left persona files on
+    disk that `_set_scope_state` never got to record.
     """
     scope = scope or "global"
+    chosen = _hook_hosts(scope, requested_host, force)
     agents = _agents_dir(scope)
     # Asked before writing: whether this run *creates* the directory decides
     # what running sessions can see (see the restart line below).
@@ -302,10 +357,10 @@ def _autopilot_on(scope, requested_host=None) -> int:
     launcher = shlex.quote(str(paths.launcher()))
     hosts = _add_hook_everywhere(
         scope, _ORIENT_HOOK, "%s bmad orient --scope %s" % (launcher, scope),
-        requested_host)
+        chosen, force)
     _add_hook_everywhere(scope, _ROUTE_HOOK,
                          "%s bmad route --scope %s" % (launcher, scope),
-                         requested_host)
+                         chosen, force)
     _set_scope_state(scope, autopilot=True, startup=True, personas=present,
                      enabled_at=util.now_iso())
     journal.log("bmad-autopilot", "on", scope=scope, personas=present)
@@ -335,9 +390,10 @@ def _autopilot_on(scope, requested_host=None) -> int:
     return 0
 
 
-def _autopilot_off(scope) -> int:
+def _autopilot_off(scope, force: bool = False) -> int:
     scope = scope or "global"
-    hooks_removed = _remove_hook_everywhere(scope, _ORIENT_HOOK, _ROUTE_HOOK)
+    hooks_removed = _remove_hook_everywhere(scope, _ORIENT_HOOK, _ROUTE_HOOK,
+                                            force=force)
     removed = core.remove_personas(_agents_dir(scope))
     _set_scope_state(scope, autopilot=False, startup=False, personas=0)
     journal.log("bmad-autopilot", "off", scope=scope, personas=len(removed))
@@ -350,6 +406,15 @@ def _autopilot_off(scope) -> int:
 def _read_hook_stdin() -> dict:
     """Claude Code's UserPromptSubmit payload, or {} for anything unreadable.
 
+    One reader for every host, because the payload keys are the same on all
+    three. Measured for Codex, not assumed: its
+    ``user-prompt-submit.command.input`` schema requires ``prompt``,
+    ``session_id``, ``cwd`` and ``hook_event_name`` under exactly Claude's
+    snake_case spellings (plus ``model``/``permission_mode``/``turn_id`` of
+    its own). A different spelling would have reached ``_route`` as an empty
+    prompt, classified TRIVIAL, and printed nothing — silently, because
+    ``_host_command`` ends the hook in ``2>/dev/null || true``.
+
     Accepts plain text too, so `echo "add tests for the scanner" | boost bmad
     route` works for a human debugging the routing table. (Give it a real
     prompt: anything under `core.MIN_WORDS` words classifies as trivial and
@@ -632,12 +697,14 @@ def _drop_retired_skills(before: dict, installed: list[str],
 
 # ----------------------------------------------------------------------- toggle
 
-def _startup(value, scope, requested_host=None) -> int:
+def _startup(value, scope, requested_host=None, force: bool = False) -> int:
     scope = scope or "project"
     if value == "on":
         cmd = "%s bmad orient --scope %s" % (
             shlex.quote(str(paths.launcher())), scope)
-        started = _add_hook_everywhere(scope, _ORIENT_HOOK, cmd, requested_host)
+        started = _add_hook_everywhere(
+            scope, _ORIENT_HOOK, cmd,
+            _hook_hosts(scope, requested_host, force), force)
         _set_scope_state(scope, startup=True)
         journal.log("bmad-startup", "on", scope=scope)
         out.ok("BMAD startup ON (%s) — new sessions get orientation" % scope)
@@ -645,7 +712,7 @@ def _startup(value, scope, requested_host=None) -> int:
             out.dim("  hook → %s" % cs.settings_path(scope, host=host))
         return 0
     if value == "off":
-        _remove_hook_everywhere(scope, _ORIENT_HOOK)
+        _remove_hook_everywhere(scope, _ORIENT_HOOK, force=force)
         _set_scope_state(scope, startup=False)
         journal.log("bmad-startup", "off", scope=scope)
         out.ok("BMAD startup OFF (%s) — skills stay installed" % scope)
@@ -692,14 +759,14 @@ def _status(scope) -> int:
 
 # ------------------------------------------------------------------- teardown
 
-def _uninstall(scope, yes) -> int:
+def _uninstall(scope, yes, force: bool = False) -> int:
     scope = scope or "project"
     if not (yes or out.confirm(
             "Remove BMAD (%s)? deletes bmad-* skills%s" % (
                 scope, " + _bmad/, _bmad-output/" if scope == "project" else ""))):
         out.info("aborted")
         return 1
-    _remove_hook_everywhere(scope, _ORIENT_HOOK, _ROUTE_HOOK)
+    _remove_hook_everywhere(scope, _ORIENT_HOOK, _ROUTE_HOOK, force=force)
     removed = _rm_skills(_skills_dir(scope))
     removed += len(core.remove_personas(_agents_dir(scope)))
     if scope == "project":
@@ -714,10 +781,10 @@ def _uninstall(scope, yes) -> int:
     return 0
 
 
-def _disable(scope) -> int:
+def _disable(scope, force: bool = False) -> int:
     """Quarantine: turn startup off and move skills aside (recoverable)."""
     scope = scope or "project"
-    _remove_hook_everywhere(scope, _ORIENT_HOOK)
+    _remove_hook_everywhere(scope, _ORIENT_HOOK, force=force)
     qdir = _quarantine_dir(scope)
     qdir.mkdir(parents=True, exist_ok=True)
     moved = 0

{boost_skill_cli-1.2.143 → boost_skill_cli-1.2.145}/boost_cli/commands/configuration.py

@@ -2237,8 +2237,10 @@ def cmd_mcp(argv) -> int:
                 out.info(" ".join(cmd))
 
     for host in done:
-        # agy has no scopes — one global file — so claiming "(scope: user)"
-        # would describe a distinction its CLI does not have.
+        # agy and Codex have no scopes — one global file each — so claiming
+        # "(scope: user)" for either would describe a distinction their CLIs
+        # do not have, and send anyone looking for a project-scoped entry
+        # after something that cannot exist.
         scope_note = " (scope: user)" if mcphost.has_scope(host) else ""
         out.ok("%sed boost as an MCP server for %s%s"
                % (verb, mcphost.label(host), scope_note))