boost-skill-cli 1.2.207__tar.gz → 1.2.208__tar.gz

{boost_skill_cli-1.2.207 → boost_skill_cli-1.2.208}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.2.207
+Version: 1.2.208
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License-Expression: Apache-2.0

{boost_skill_cli-1.2.207 → boost_skill_cli-1.2.208}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.2.207'
-__version_tuple__ = version_tuple = (1, 2, 207)
+__version__ = version = '1.2.208'
+__version_tuple__ = version_tuple = (1, 2, 208)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.2.207 → boost_skill_cli-1.2.208}/boost_cli/commands/bmad.py

@@ -579,7 +579,14 @@ def _require_npx() -> None:
             hint="install Node.js 20.12+ (e.g. `brew install node`), then retry")
 
 
-def _run_installer(directory: Path, modules: str) -> subprocess.CompletedProcess:
+def _run_installer(directory: Path, modules: str,
+                   hint: str | None = None) -> subprocess.CompletedProcess:
+    """Run the BMAD installer into `directory`.
+
+    ``hint`` replaces the default "run it yourself" one: a global install
+    stages into a temp dir that is deleted before the error is printed, so a
+    command naming it would install into nothing the user keeps.
+    """
     cmd = ["npx", "--yes", "bmad-method@%s" % core.BMAD_VERSION, "install",
            "--yes", "--directory", str(directory),
            "--tools", "claude-code", "--modules", modules,
@@ -592,15 +599,32 @@ def _run_installer(directory: Path, modules: str) -> subprocess.CompletedProcess
                               timeout=900)
     except (OSError, subprocess.TimeoutExpired) as e:
         raise BoostError("bmad install failed: %s" % e,
-                         hint="run it yourself: " + " ".join(cmd)) from e
+                         hint=hint or _run_it_yourself(cmd)) from e
     if proc.returncode != 0:
         tail = (proc.stderr or proc.stdout or "").strip().splitlines()
         raise BoostError(
             "bmad install failed: %s" % (tail[-1] if tail else "unknown error"),
-            hint="run it yourself: " + " ".join(cmd))
+            hint=hint or _run_it_yourself(cmd))
     return proc
 
 
+def _run_it_yourself(cmd: list[str]) -> str:
+    """The hint naming the installer argv, quoted so it pastes as one command.
+
+    Backticked because the hint folds to the pane and only a backtick span is
+    atomic: a fold at the space inside `'/h/my proj'` pastes as a dangling quote.
+    """
+    return "run it yourself: `%s`" % util.shell_join(cmd)
+
+
+def _global_retry_hint(modules: str) -> str:
+    """What to re-run after a failed global install, whose stage is gone."""
+    argv = ["boost", "bmad", "install", "--scope", "global"]
+    if modules != DEFAULT_MODULES:
+        argv += ["--modules", modules]
+    return "once npx works, re-run `%s`" % util.shell_join(argv)
+
+
 def _whoami() -> str:
     try:
         return getpass.getuser()
@@ -671,7 +695,8 @@ def _copy_global_skills(modules) -> tuple[str, list[str]]:
     """
     stage = Path(tempfile.mkdtemp(prefix="boost-bmad-"))
     try:
-        proc = _run_installer(stage, modules)
+        proc = _run_installer(stage, modules,
+                              hint=_global_retry_hint(modules))
         ver = _parse_version((proc.stdout or "") + (proc.stderr or ""))
         src = stage / ".claude" / "skills"
         dest = _skills_dir("global")

{boost_skill_cli-1.2.207 → boost_skill_cli-1.2.208}/boost_cli/commands/configuration.py

@@ -1737,6 +1737,8 @@ def _tool_list(args: dict):
     if not any(everything.values()) and not project:
         return "nothing installed\n" + footer, False
     lines = []
+    # `[modified]` hashes each installed skill copy, as `boost list` does --
+    # the one cost here beyond the lock reads, 0.2-0.4 ms per fixture skill.
     for kind, section in everything.items():
         for n, e in sorted(section.items()):
             where = scopes.project_label(e) if kind != "skill" else None
@@ -1744,12 +1746,14 @@ def _tool_list(args: dict):
                          % (n, e.get("version", "?"), e.get("tap", "?"),
                             "" if kind == "skill" else " [%s]" % kind,
                             " [project %s]" % where if where else "",
-                            mcp.state_marks(e)))
+                            mcp.state_marks(e, kind == "skill" and integrity
+                                            .locally_edited(kind, n, e))))
     if project:
         lines.append("project skills (%s):" % _tilde(pbase))
         lines.extend("%s v%s (%s) [project]%s"
                      % (n, e.get("version", "?"), e.get("tap", "?"),
-                        mcp.state_marks(e))
+                        mcp.state_marks(e, integrity.locally_edited(
+                            "skill", n, e, base=pbase)))
                      for n, e in sorted(project.items()))
     lines.append(footer)
     return "\n".join(lines), False
@@ -1837,6 +1841,12 @@ def _tool_info(args: dict):
                  else scopes.project_label(entry))
         if where:
             lines.append("scope: project (%s)" % where)
+        if kind == "skill" and integrity.locally_edited(
+                kind, catalog.split_name(name)[1], entry, base=pbase):
+            # Doctor's and verify's check: the body an agent reads next is
+            # not the tap's.
+            lines.append("modified: yes — edited since install; `boost "
+                         "verify` names it")
         if entry.get("pinned"):
             lines.append("pinned: yes")
         if entry.get("quarantined"):

{boost_skill_cli-1.2.207 → boost_skill_cli-1.2.208}/boost_cli/commands/discovery.py

@@ -2745,10 +2745,16 @@ def cmd_stats(argv):
     size = util.dir_size(sdir) if sdir and lock and sdir.is_dir() else None
     scope = (scopes.SCOPE_PROJECT if prow is not None
              else scopes.SCOPE_USER if lock else None)
+    # Edited since install, by doctor's and verify's own check, as `list`
+    # and `info` report it.
+    edited = (lock is not None and kind == "skill"
+              and integrity.locally_edited(
+                  "skill", name, lock,
+                  base=prow.base if prow is not None else None))
     if args.as_json:
         print(json.dumps({
             "name": name, "kind": kind, "installed": bool(lock), "lock": lock,
-            "scope": scope,
+            "scope": scope, "modified": edited,
             "size": size, "activity": acts,
             "catalog": ({"latest": latest, "tap": cat["tap"],
                          "description": cat["description"],
@@ -2782,6 +2788,9 @@ def cmd_stats(argv):
         if lock.get("quarantined"):
             out.kv("quarantined", "yes")
         out.kv("sha256", str(lock.get("sha256", ""))[:12])
+        if edited:
+            out.kv("modified", out.role("yes", "warn")
+                   + out.role("  (edited since install)", "muted"))
         if size is not None:
             out.kv("size", util.human_size(size))
         if cat and cat.get("description"):

{boost_skill_cli-1.2.207 → boost_skill_cli-1.2.208}/boost_cli/commands/info.py

@@ -297,8 +297,8 @@ def _print_wrapped(text: str) -> None:
 # ---------------------------------------------------------------- commands
 
 def _materialized_agents(kind, entry):
-    """Abbreviated agent column for a rule/workflow: the agents boost still
-    writes for it, not every recorded row (`integrity.written_agent_names`)."""
+    """Abbreviated agent column for any kind: the agents boost still writes
+    for it, not every recorded row or link (`integrity.written_agent_names`)."""
     return "·".join(a.split("-")[0]
                     for a in integrity.written_agent_names(kind, entry))
 
@@ -410,13 +410,26 @@ def cmd_list(argv):
     # A row whose store dir is gone is a skill no agent can load: doctor says
     # so, and list printed it beside the healthy ones with an empty FLAGS.
     gone = {n for n, e in skills.items() if store.missing_from_store(n, e)}
+    # A copy edited since install, by the check doctor and verify make
+    # (`integrity.locally_edited`): without it a hand-edited skill looked
+    # pristine here while both of them flagged it. It hashes each installed
+    # copy, which is the cost of this command -- measured on the fixture at
+    # 0.2-0.4 ms per skill, so 200 skills add well under 0.1 s; a skill
+    # shipping large assets costs what reading them costs.
+    edited = {n for n, e in skills.items()
+              if n not in gone and integrity.locally_edited("skill", n, e)}
+    pedited = {n for n, e in project.items()
+               if integrity.locally_edited("skill", n, e, base=pbase)}
     if args.json:
         # Marked on a copy, and only when true, so a healthy row is still
         # the lock's row byte for byte.
-        shown = {n: (e | {"missing_from_store": True} if n in gone else e)
+        shown = {n: (e | ({"missing_from_store": True} if n in gone else {})
+                     | ({"modified": True} if n in edited else {}))
                  for n, e in skills.items()}
+        pshown = {n: (e | {"modified": True} if n in pedited else e)
+                  for n, e in project.items()}
         print(json.dumps({"skills": shown, "rules": rules,
-                          "workflows": workflows, "project": project},
+                          "workflows": workflows, "project": pshown},
                          indent=2, sort_keys=True))
         return 0
     # Every row below is a tap's frontmatter by way of the lock (version,
@@ -448,6 +461,7 @@ def cmd_list(argv):
             # colored cells stay in their column: pinned amber, quarantined pink,
             # tags dim.
             flags = ([out.role("missing", "danger")] if name in gone else []) + \
+                    ([out.role("modified", "warn")] if name in edited else []) + \
                     ([out.aurora("pinned", "yellow")] if e.get("pinned") else []) + \
                     ([out.aurora("quarantined", "pink")] if e.get("quarantined")
                      else []) + \
@@ -455,8 +469,7 @@ def cmd_list(argv):
                      if e.get("sidelined_by") else []) + \
                     [out.role("#" + t, "muted") for t in e.get("tags") or []]
             rows.append((name, e.get("version", "?"), e.get("tap", "?"),
-                         "·".join(a.split("-")[0] for a in e.get("agents") or []),
-                         " ".join(flags)))
+                         _materialized_agents("skill", e), " ".join(flags)))
         # NAME is what `uninstall`/`update`/`cat` take: `brainstorm…` is not
         # a name any of them accepts, so it is shown whole or dropped.
         out.table(rows, headers=("NAME", "VERSION", "TAP", "AGENTS", "FLAGS"),
@@ -479,8 +492,11 @@ def cmd_list(argv):
         # holds `update` off this row, and a pinned row that looked like any
         # other was visible only in --json.
         rows = [(name, e.get("version", "?"), e.get("tap", "?"),
-                 "·".join(a.split("-")[0] for a in e.get("agents") or []),
-                 out.aurora("pinned", "yellow") if e.get("pinned") else "")
+                 _materialized_agents("skill", e),
+                 " ".join(([out.role("modified", "warn")]
+                           if name in pedited else [])
+                          + ([out.aurora("pinned", "yellow")]
+                             if e.get("pinned") else [])))
                 for name, e in sorted(project.items())]
         out.table(rows, headers=("NAME", "VERSION", "TAP", "AGENTS", "FLAGS"),
                   whole=("NAME",))
@@ -691,9 +707,15 @@ def cmd_info(argv):
     if not (lock or plock) and cat and kind == "skill":
         submodules = store.unfetched_submodules(cat)
 
+    # Edited since install, by doctor's and verify's own check. Either
+    # scope's copy counts: `boost update` refuses to overwrite either one.
+    edited = bool((lock and integrity.locally_edited("skill", name, lock))
+                  or (plock and integrity.locally_edited(
+                      "skill", name, plock, base=pbase)))
     if args.json:
         print(json.dumps({
             "name": name, "kind": kind, "description": desc,
+            "modified": edited,
             "submodules": submodules,
             "upstream_description": upstream or None,
             "installed": lock, "project": plock,
@@ -735,6 +757,8 @@ def cmd_info(argv):
         badges.append(out.badge("installed", "green"))
         if store.missing_from_store(name, lock):
             badges.append(out.badge("missing from store", "pink"))
+        if edited:
+            badges.append(out.badge("modified", "yellow"))
         if lock.get("pinned"):
             badges.append(out.badge("pinned", "yellow"))
         if lock.get("quarantined"):
@@ -747,6 +771,8 @@ def cmd_info(argv):
             badges.append(out.badge("also in this project", "green"))
     elif plock:
         badges.append(out.badge("installed in this project", "green"))
+        if edited:
+            badges.append(out.badge("modified", "yellow"))
         if plock.get("pinned"):
             badges.append(out.badge("pinned", "yellow"))
     else:
@@ -835,7 +861,10 @@ def cmd_info(argv):
             out.kv("installed", "%s (%s)" % (ia, util.rel_time(ia)))
         if ua and ua != ia:
             out.kv("updated", "%s (%s)" % (ua, util.rel_time(ua)))
-        out.kv("agents", ", ".join(entry.get("agents") or []) or "(none)")
+        # Written agents only, as for a rule: a link left in a disabled
+        # agent's dir is kept for uninstall, not one boost still writes.
+        out.kv("agents", ", ".join(
+            integrity.written_agent_names("skill", entry)) or "(none)")
     if plock and not lock:
         # Which copy the rows above describe. Only worth saying when there is
         # no user-scope record to confuse it with.
@@ -962,7 +991,7 @@ def cmd_edit(argv):
         # lock, hiding the edit from `boost drift` (which would then fall
         # through to UPSTREAM_MOVED instead of LOCAL_EDITS). The journal is
         # the record of the edit; drift/attest compare honestly instead.
-        if util.sha256_dir(sdir) == row.get("sha256"):
+        if util.sha256_matches(sdir, row.get("sha256")):
             return False
         row["updated_at"] = util.now_iso()
         return True
@@ -1315,7 +1344,7 @@ def cmd_log(argv):
                 hint="re-tap it with `boost tap`, or see `boost taps`") from None
         if not tap.is_cloned:
             raise BoostError("tap %s is not cloned" % tap.name,
-                            hint="run `boost update %s`" % tap.name)
+                            hint="run `boost update %s`" % util.shell_arg(tap.name))
         if args.as_json:
             # `log_entries`, not a re-split of the display format: the columns
             # there are two-space separated and an author or subject may

{boost_skill_cli-1.2.207 → boost_skill_cli-1.2.208}/boost_cli/commands/intelligence.py

@@ -168,10 +168,9 @@ def _install_generated(name: str, text: str, yes: bool = False) -> bool:
         src = Path(td) / name
         src.mkdir()
         # newline="\n": install_from_path copies this into the canonical
-        # store and records util.sha256_dir over it, which hashes read_bytes.
-        # Every comparison against that hash is local today, so this is
-        # latent rather than live — but the digest it stamps into the lock
-        # would otherwise depend on which OS generated the skill.
+        # store and records util.sha256_dir over it. That hash folds CRLF
+        # now, but the copy itself would still carry whichever line endings
+        # the generating OS wrote.
         (src / "SKILL.md").write_text(text, encoding="utf-8", newline="\n")
         try:
             res = store.install_from_path(src, name=name, tap_label="local")

{boost_skill_cli-1.2.207 → boost_skill_cli-1.2.208}/boost_cli/commands/pkg.py

@@ -925,6 +925,15 @@ def _project_fallback(names: list[str]) -> tuple[list[str], Path | None]:
     return here, (base if here else None)
 
 
+def _rm_target(base, row: str) -> str:
+    """``base/row`` as one shell word for an `rm -rf` hint.
+
+    The real path, not the `~`-tilded one the prose uses: once quoted, a `~`
+    no longer expands, and a repo path with a space split in two unquoted.
+    """
+    return util.shell_arg("%s/%s" % (base, row) if base else row)
+
+
 def cmd_uninstall(argv: list[str]) -> int:
     ap = cliparse.parser(
         prog="boost uninstall",
@@ -1069,8 +1078,10 @@ def cmd_uninstall(argv: list[str]) -> int:
                 out.warn("left alone: the lock names %s, but a symlink inside "
                          "the repo redirects the path to it. boost will not "
                          "delete through a symlink it did not create; "
-                         "`rm -rf %s/%s` removes it if it is yours."
-                         % (out.plain(row), at, out.plain(row)), wrap=True)
+                         "`rm -rf %s` removes it if it is yours."
+                         % (out.plain(row), _rm_target(info.get("base"),
+                                                        out.plain(row))),
+                         wrap=True)
             if refused:
                 # The derived set, not a `<repo>/<dotdir>/skills/<name>`
                 # shape: the leaf comes from the agent's `dir`, so the shape
@@ -2997,8 +3008,9 @@ def _warn_import(res: store.InstallResult, narrowed: bool) -> None:
     if res.replaced_tap:
         out.warn("%s was installed from %s — it is a local import now, so "
                  "`boost update` will not refresh it "
-                 "(`boost install %s:%s --force` puts the tap's copy back)"
-                 % (res.name, res.replaced_tap, res.replaced_tap, res.name),
+                 "(`boost install %s --force` puts the tap's copy back)"
+                 % (res.name, res.replaced_tap,
+                    util.shell_arg("%s:%s" % (res.replaced_tap, res.name))),
                  wrap=True)
     if res.out_of_scope:
         out.warn("%s is still linked into %s, outside the --agent scope %s "
@@ -3118,7 +3130,7 @@ def cmd_pin(argv: list[str]) -> int:
     _add_pin_scope(ap, "pin")
     args = ap.parse_args(argv)
     args.name = store.installed_name(args.name, args.scope)
-    row = _pin_target(args.name, args.scope, "pin")
+    row = _pin_target(args.name, args.scope, "pin", commit=args.commit)
     if args.commit and row is not None:
         # `verify` never grades a project row's commit pin, so writing one
         # would promise a check that does not exist.
@@ -3177,13 +3189,16 @@ def _add_pin_scope(ap, verb: str) -> None:
         global_help="the copy in your user config (= --scope user)")
 
 
-def _pin_target(name: str, scope: str | None,
-                verb: str) -> integrity.InstalledSkill | None:
+def _pin_target(name: str, scope: str | None, verb: str,
+                commit: bool = False) -> integrity.InstalledSkill | None:
     """The project row ``pin``/``unpin`` acts on, or None for the user lock.
 
     Unscoped, a name only this repo holds is the project row, as before. A
     name both scopes hold is refused: acting on the user row alone pinned it
     while `boost update` moved the repo's copy, with nothing said about it.
+    ``commit`` is ``pin --commit``, which the hint must keep: dropped, the
+    suggested command set a version pin and no commit pin. It offers no
+    ``--local`` form then, because ``--commit`` is refused at project scope.
     """
     base, project = integrity.project_skills()
     prow = project.get(name)
@@ -3207,8 +3222,11 @@ def _pin_target(name: str, scope: str | None,
     if lockfile.find_any(name) is not None:
         raise BoostError("%s is installed in your user config and in this "
                          "repo — say which to %s" % (name, verb),
-                         hint="`boost %s %s --global` or `boost %s %s --local`"
-                              % (verb, name, verb, name))
+                         hint=("`boost %s %s --commit --global` — --commit "
+                               "applies to user-scope installs" % (verb, name)
+                               if commit else
+                               "`boost %s %s --global` or `boost %s %s --local`"
+                               % (verb, name, verb, name)))
     return integrity.InstalledSkill(name, prow, scopes.SCOPE_PROJECT, base, None)
 
 

{boost_skill_cli-1.2.207 → boost_skill_cli-1.2.208}/boost_cli/commands/quality.py

@@ -287,6 +287,12 @@ def _drift_from_copy(name: str, entry: dict, copy_sha: str | None,
     """
     is_local = entry.get("tap") == "local"
     lock_sha = entry.get("sha256", "")
+    if (copy_sha is not None and copy is not None and copy_sha != lock_sha
+            and util.sha256_matches(copy, lock_sha)):
+        # A row recorded before the hash folded CRLF, whose copy held some:
+        # the copy is intact, so compare it and the source in today's digest
+        # rather than call it local edits or upstream-moved.
+        lock_sha = copy_sha
     source_sha = None
     changed = exec_changed = False
     if copy_sha is not None and copy_sha == lock_sha and not is_local:
@@ -309,7 +315,7 @@ def _rewound_or(status: str, kind: str, name: str, entry: dict) -> str:
     """``status``, or ``upstream-rewound`` for a move to an older version.
 
     A tap force-pushed back to an earlier release reads as upstream-moved,
-    whose hint is `boost update` -- which holds it ("update skipped") on
+    whose unpinned hint is `boost update` -- which holds it ("update skipped") on
     every run. The catalog version is read only for an unpinned
     upstream-moved row, and only from the item's own tap: a pinned one is
     held by its pin, which ``--allow-downgrade`` does not release.
@@ -352,8 +358,7 @@ def _drift_status_project(name: str, entry: dict, base: Path) -> str:
     if st == integrity.STATUS_MODIFIED:
         return staleness.LOCAL_EDITS
     d = integrity.project_skill_dir(entry, base)
-    copy_sha = (entry.get("sha256", "") if st == integrity.STATUS_OK
-                else util.sha256_dir(d) if d is not None else None)
+    copy_sha = util.sha256_dir(d) if d is not None else None
     return _drift_from_copy(name, entry, copy_sha, d)
 
 
@@ -419,13 +424,23 @@ _DRIFT_ROLE = {"in-sync": "success", "local-edits": "warn",
 
 
 def _drift_hint(name: str, status: str, tap: str = "",
-                tap_url: str = "", scope: str | None = None) -> str:
+                tap_url: str = "", scope: str | None = None,
+                pinned: bool = False, unpin_flag: str = "") -> str:
     # A reinstall of a project row needs `--local`: bare `reinstall` reads the
     # user lock and, given a same-named user install, reinstalls that instead.
     local = " --local" if scope == scopes.SCOPE_PROJECT else ""
     if status == "quarantined":
         return "boost quarantine --release %s to restore" % name
     if status == "upstream-moved":
+        # `boost update` holds a pinned row back on every run ("pinned item
+        # has an update held back"), so naming it alone looped. The pin is
+        # released first -- `--local` for a project row, which unscoped
+        # `unpin` refuses when both scopes hold the name (``unpin_flag``
+        # carries `--global` for that user row). A pin on a rewound tap
+        # also needs `--allow-downgrade` once released (not judged here).
+        if pinned:
+            return ("pinned — boost unpin %s%s, then boost update"
+                    % (name, local or unpin_flag))
         return "boost update"
     if status == staleness.UPSTREAM_REWOUND:
         # `boost update` holds a rewind back on every run; only the flag
@@ -629,7 +644,7 @@ def _mat_remedy(off: list[tuple[str, str, str, str]]) -> str:
                             if r in reasons))
     if reasons & set(agents.CONFIG_REASONS):
         return ("Change that agent's entry in %s and run `boost sync`, or "
-                "%s.%s" % (paths.config_path(), drop, tail))
+                "%s.%s" % (_tilde(paths.config_path()), drop, tail))
     return ("%s, or leave it \u2014 the row is what lets a later uninstall "
             "remove the artifact.%s" % (drop, tail))
 
@@ -792,7 +807,7 @@ def cmd_doctor(argv):
             # was, and this line used to send the user straight back to it.
             bad("tap", "tap %s not cloned — run `boost update %s` to clone it "
                 "at its pin %s; if that commit is gone upstream, %s"
-                % (tap.name, tap.name, tap.pin[:7],
+                % (tap.name, util.shell_arg(tap.name), tap.pin[:7],
                    registry.pin_missing_remedy(tap.name)), wrap=True)
         elif not tap.is_cloned:
             bad("tap", "tap %s not cloned — run `boost update`" % tap.name)
@@ -806,11 +821,12 @@ def cmd_doctor(argv):
             bad("tap", "tap %s is pinned at %s but its clone is at %s — run "
                 "`boost update %s` to return it, or `boost update --force %s` "
                 "to follow its default branch"
-                % (tap.name, tap.pin[:7], head[:7], tap.name, tap.name),
+                % (tap.name, tap.pin[:7], head[:7], util.shell_arg(tap.name),
+                   util.shell_arg(tap.name)),
                 wrap=True)
         elif not tap.cache_file.exists():
             bad("tap", "tap %s has no catalog cache — run `boost update %s`%s"
-                % (tap.name, tap.name, " once %s is %s"
+                % (tap.name, util.shell_arg(tap.name), " once %s is %s"
                    % (_tilde(cache_block), "moved aside" if cache_moved
                       else "writable") if cache_block else ""), wrap=True)
         elif (moved := catalog.stale_commit(tap)) is not None:
@@ -1911,7 +1927,7 @@ def cmd_lint(argv):
         tap = registry.get(args.tap)
         if not tap.is_cloned:
             raise BoostError("tap %s is not cloned" % tap.name,
-                            hint="run `boost update %s`" % tap.name)
+                            hint="run `boost update %s`" % util.shell_arg(tap.name))
         targets, skipped = catalog.lint_targets(
             catalog.load_tap(tap), tap.path, args.names or None)
     else:
@@ -2039,7 +2055,10 @@ def cmd_drift(argv):
                 if (kind == "skill" and status == staleness.STORE_MISSING
                     and store.is_held(entry))
                 else _drift_hint(name, status, entry.get("tap", ""),
-                                 str(entry.get("tap_url") or "")))
+                                 str(entry.get("tap_url") or ""),
+                                 pinned=bool(entry.get("pinned")),
+                                 unpin_flag=(" --global" if name in pskills
+                                             else "")))
         rows.append({"name": name, "kind": kind, "scope": scope,
                      "status": status, "hint": hint})
     for name, entry in sorted(pskills.items()):
@@ -2051,7 +2070,8 @@ def cmd_drift(argv):
         hint = ("boost sync" if status == staleness.STORE_MISSING
                 else _drift_hint(name, status, entry.get("tap", ""),
                                  str(entry.get("tap_url") or ""),
-                                 scope=scopes.SCOPE_PROJECT))
+                                 scope=scopes.SCOPE_PROJECT,
+                                 pinned=bool(entry.get("pinned"))))
         rows.append({"name": name, "kind": "skill",
                      "scope": scopes.SCOPE_PROJECT, "status": status,
                      "hint": hint})
@@ -2103,7 +2123,7 @@ def cmd_test(argv):
         if util.lint_failed(sdir, score, min_score=40):
             failed.append("lint")
         if not sdir.is_dir() or (not integrity.self_sourced(name, entry)
-                                 and util.sha256_dir(sdir) != entry.get("sha256")):
+                                 and not util.sha256_matches(sdir, entry.get("sha256"))):
             failed.append("verify")
         if len(body.encode("utf-8")) > 64 * 1024:
             failed.append("size")
@@ -2758,7 +2778,7 @@ def cmd_changelog(argv):
     tap = registry.get(tap_name)
     if not tap.is_cloned:
         raise BoostError("tap %s is not cloned" % tap.name,
-                        hint="run `boost update %s`" % tap.name)
+                        hint="run `boost update %s`" % util.shell_arg(tap.name))
     if args.json:
         # `log_entries` parses on an ASCII unit separator rather than
         # re-splitting the display format, whose two-space column gap a commit
@@ -3022,7 +3042,7 @@ def cmd_trust(argv) -> int:
             tap = registry.get(args.name)
             if not tap.is_cloned:
                 raise BoostError("tap %s is not cloned" % tap.name,
-                                 hint="`boost update %s`" % tap.name)
+                                 hint="`boost update %s`" % util.shell_arg(tap.name))
             results = [(tap.name, provenance.verify_dir(tap.path))]
         else:
             results = _tap_provenance_rows()

{boost_skill_cli-1.2.207 → boost_skill_cli-1.2.208}/boost_cli/commands/taps.py

@@ -484,6 +484,37 @@ def _outdated_qualifier(r: dict) -> str:
     return " (%s)" % ", ".join(tags) if tags else ""
 
 
+def _outdated_holds(r: dict) -> str:
+    """INSTALLED-column suffix naming what holds the row where it is.
+
+    `boost update` skips a pinned or quarantined item and an item with local
+    edits ("has local edits — update skipped"), so a row showing none of the
+    three read as a plain upgrade that the next run would take.
+    """
+    tags = [tag for tag, on in (("pinned", r["pinned"]),
+                                ("quarantined", r["quarantined"]),
+                                ("local edits", r["local_edits"])) if on]
+    return " (%s)" % ", ".join(tags) if tags else ""
+
+
+def _held_by_edits(reason: str | None, kind: str, name: str, lk: dict,
+                   base=None) -> bool:
+    """Whether `boost update` would hold this row back for its local edits.
+
+    Asked only of a row with an upgrade to take, so `outdated` hashes no copy
+    it has nothing to say about -- and the question is `boost update`'s own
+    (:func:`integrity.locally_edited`), so the two cannot disagree. Update
+    checks quarantine, then the pin, then the edits: a quarantined or pinned
+    row is held by that first (an `evolve --apply` revision is pinned *and*
+    reads as edited), so it is not reported as held by its edits.
+    """
+    if (reason not in (staleness.VERSION, staleness.CONTENT,
+                       staleness.DOWNGRADE)
+            or lk.get("quarantined") or lk.get("pinned")):
+        return False
+    return integrity.locally_edited(kind, name, lk, base=base)
+
+
 def _held_tap_reason(tap_name: str, lk: dict,
                      memo: dict[str, registry.Tap | None]) -> str | None:
     """Why a row of a *configured* tap cannot be compared at all, else None.
@@ -542,7 +573,8 @@ def cmd_outdated(argv) -> int:
                             "latest": None, "reason": held,
                             "latest_commit": None,
                             "tap": tap_name, "pinned": bool(lk.get("pinned")),
-                            "scope": scope})
+                            "quarantined": bool(lk.get("quarantined")),
+                            "local_edits": False, "scope": scope})
             continue
         # Skills only: a same-named workflow upstream is not this skill's
         # update, and listing it as one sent `boost update` to "upgrade" it.
@@ -558,7 +590,8 @@ def cmd_outdated(argv) -> int:
                             "reason": staleness.SOURCE_MISSING,
                             "latest_commit": None,
                             "tap": tap_name, "pinned": bool(lk.get("pinned")),
-                            "scope": scope})
+                            "quarantined": bool(lk.get("quarantined")),
+                            "local_edits": False, "scope": scope})
             continue
         entry, _warning = catalog.select_lock_source(matches, lk)
         entry = cast(dict, entry)             # matches is non-empty above
@@ -585,7 +618,8 @@ def cmd_outdated(argv) -> int:
                         else store.skill_store_dir(name))
         base = {"name": name, "kind": "skill", "installed": installed_v,
                 "tap": tap_name, "pinned": bool(lk.get("pinned")),
-                "scope": scope}
+                "quarantined": bool(lk.get("quarantined")),
+                "local_edits": False, "scope": scope}
         if src_missing:
             results.append(base | {"latest": None,
                                    "reason": staleness.SOURCE_MISSING,
@@ -595,6 +629,9 @@ def cmd_outdated(argv) -> int:
                 installed_v, latest, lk.get("commit", ""), head,
                 lk.get("sha256", ""), src_sha, exec_changed),
                 installed_v, latest, pinned=bool(lk.get("pinned")))
+            base["local_edits"] = _held_by_edits(
+                reason, "skill", name, lk,
+                _base if scope == scopes.SCOPE_PROJECT else None)
             if reason == staleness.VERSION:
                 results.append(base | {"latest": latest,
                                        "reason": staleness.VERSION,
@@ -615,6 +652,8 @@ def cmd_outdated(argv) -> int:
             installed_v = str(lk.get("version") or "0.0.0")
             base = {"name": name, "kind": kind, "installed": installed_v,
                     "tap": tap_name, "pinned": bool(lk.get("pinned")),
+                    "quarantined": bool(lk.get("quarantined")),
+                    "local_edits": False,
                     "scope": lk.get("scope") or scopes.SCOPE_USER}
             held = _held_tap_reason(tap_name, lk, tap_memo)
             if held:
@@ -635,6 +674,7 @@ def cmd_outdated(argv) -> int:
                 continue
             reason = staleness.rewound(reason, installed_v, r_latest,
                                        pinned=bool(lk.get("pinned")))
+            base["local_edits"] = _held_by_edits(reason, kind, name, lk)
             # Rules/workflows carry no tap-HEAD commit here (only a source-file
             # sha comparison), so `latest_commit` stays unset — `_outdated_display`
             # falls back to the same "(content changed)" wording skills used to
@@ -654,7 +694,7 @@ def cmd_outdated(argv) -> int:
     # Both version columns are a tap's frontmatter: display copies only.
     results = out.plain_fields(results)
     rows = [(r["name"] + _outdated_qualifier(r),
-             r["installed"] + (" (pinned)" if r["pinned"] else ""),
+             r["installed"] + _outdated_holds(r),
              _outdated_display(r, configured), r["tap"]) for r in results]
     # NAME is what `boost update`/`upgrade` take.
     out.table(rows, headers=("NAME", "INSTALLED", "LATEST", "TAP"),
@@ -663,11 +703,17 @@ def cmd_outdated(argv) -> int:
     missing = [r for r in results if r["reason"] == staleness.SOURCE_MISSING]
     removed = sum(1 for r in missing if r["tap"] in configured)
     reasons = [r["reason"] for r in results]
+    # Only a row `boost update` would otherwise take is held by these two: a
+    # rewound or missing row is already counted under its own reason.
+    upgrades = [r for r in results
+                if r["reason"] in (staleness.VERSION, staleness.CONTENT)]
     out.dim(staleness.outdated_footer(
         len(results), len(missing), removed,
         source_changed=reasons.count(staleness.SOURCE_CHANGED),
         not_cloned=reasons.count(staleness.NOT_CLONED),
-        downgrade=reasons.count(staleness.DOWNGRADE)))
+        downgrade=reasons.count(staleness.DOWNGRADE),
+        quarantined=sum(1 for r in upgrades if r["quarantined"]),
+        local_edits=sum(1 for r in upgrades if r["local_edits"])))
     return 0