boost-skill-cli 1.2.29__tar.gz → 1.2.31__tar.gz

{boost_skill_cli-1.2.29 → boost_skill_cli-1.2.31}/CLAUDE.md

@@ -339,6 +339,25 @@ for code you write:
   stale-link sweeps, coverage counts). `agents.enabled_agents()` is still right
   for rules and workflows, which materialize into `~/.gemini/` like any other
   agent's dotdir. `agents.native_store_agents()` is the complement, for reporting.
+- **Boost not linking there does not mean nothing else does**, and the warning
+  costs the user the same either way. `store.duplicate_discovery()` walks
+  `native_store_agents()` for entries that resolve back into the canonical
+  store — one skill in two of that agent's discovery tiers, whoever wrote it.
+  On a real machine 24 of the 25 entries in `~/.gemini/skills` led to
+  `~/.claude/skills` directories boost does not manage, and one resolved into
+  the store, so the test is **topology, not ownership**: a sweep of "boost's
+  stale links" would have deleted two dozen files belonging to another tool.
+  `boost doctor` counts each hit as an issue; `boost heal` names them and
+  removes nothing; `boost heal --prune-duplicates` removes them, re-checking at
+  the point of deletion that the entry is still a symlink still resolving into
+  the store. A real directory is never touched.
+- **`points_into_store` and `resolves_into_store` answer different questions.**
+  The first reads one `readlink()` because it judges *broken* links, where
+  there is nothing to resolve. The second follows the whole chain, because the
+  live shape is `~/.gemini/skills/x -> ../../.claude/skills/x -> the store` and
+  one hop lands in another agent's dir. It resolves **both sides**: on macOS a
+  `$HOME` under `/var/folders` resolves to `/private/var/...`, so resolving
+  only the target compares a real path against a nominal one and never matches.
 - Per-agent *formats* differ and are pure functions in `core/`: `rules.CONTEXT_FILES`
   maps an agent with no rules dir to its context file (`claude-code` → CLAUDE.md /
   CLAUDE.local.md, `gemini` → GEMINI.md for both scopes), and
@@ -350,6 +369,39 @@ for code you write:
   Gemini disagree on name position, the `--` separator, and whether unregister
   needs an explicit scope — all three verified against the real CLIs and pinned
   by `tests/unit/test_mcphost.py`. Don't "simplify" them into one shape.
+- **`core/hookhost.py` is the same idea for hooks, and two hosts have them.**
+  `boost hooks` writes Claude Code's `~/.claude/settings.json` (the default,
+  unchanged) or, behind `--host gemini`, the `~/.gemini/settings.json` that
+  Gemini CLI reads;
+  `core/claude_settings.py` takes `host=` throughout and asks the table for the
+  differences. The `hooks` key and the `{matcher, hooks: [{type, command,
+  timeout}]}` block shape are *identical* between them, which is exactly what
+  makes the three real differences easy to ship wrong:
+  - **`timeout` units.** Claude's is **seconds**; Gemini's is **milliseconds**
+    (`DEFAULT_HOOK_TIMEOUT = 6e4`, fed straight to `setTimeout`). Callers pass
+    seconds and `hookhost.hook_entry` converts, so boost's `--timeout 10` is ten
+    seconds on both. Gemini's own `hooks migrate --from-claude` copies the number
+    verbatim, which turns a 10-second Claude hook into a 10-**millisecond**
+    Gemini one; don't copy that.
+  - **Event names.** Only `SessionStart`, `SessionEnd` and `Notification` are
+    spelled alike. `CLAUDE_TO_GEMINI` maps all ten Claude events explicitly and
+    `tests/unit/test_hookhost.py` fails if one is missing. `SubagentStop` and
+    `SubagentStart` map to **`None`** — Gemini has no sub-agents, so boost
+    refuses the hook and says why. (The upstream `EVENT_MAPPING` means to fold
+    them into `AfterAgent` but keys `SubAgentStop`, a spelling Claude never
+    emits, so `migrate` writes an event Gemini can never fire.)
+  - **The `name` field.** Gemini's hook config takes one — it is what
+    `/hooks panel` shows and `/hooks enable <name>` targets — and Claude's does
+    not. The `# boost:<name>` command marker stays the ownership mechanism for
+    both; `name` is added on top for Gemini, never instead.
+  A `matcher` is **not** translated: `boost hooks add` is not porting a config,
+  so it stays host-native — for a Gemini tool event it is a regular expression
+  over *Gemini* tool names like `run_shell_command`, and for a lifecycle event
+  it is an exact string. All of this was established against Gemini CLI
+  0.57.0's own bundle — the `docs/hooks/` it ships, the `HookEventName` list and
+  `EVENT_MAPPING` in the bundled JS, and an observed `migrate` run — and those
+  sources are named at the top of `hookhost.py` so the next person can re-check
+  them against a newer release.
 
 `core/catalog.scan_dir` walks a tap's clone and classifies each file into one
 of the three item kinds (see Non-obvious rules above); `core/store.py` owns

{boost_skill_cli-1.2.29 → boost_skill_cli-1.2.31}/CONTRIBUTING.md

@@ -128,6 +128,13 @@ published release, to record an assertion nobody actually made.
 Bot authors (Dependabot and friends) are exempt — an account cannot agree to a
 certificate.
 
+## Governance
+
+Who decides, how a decision gets made, and what happens when people disagree:
+[GOVERNANCE.md](GOVERNANCE.md). Who holds which role and which credential:
+[MAINTAINERS.md](MAINTAINERS.md). Both say plainly that this is a
+single-maintainer project today rather than implying a committee.
+
 ## Code of conduct
 
 Participation is governed by the [Code of Conduct](CODE_OF_CONDUCT.md)

boost_skill_cli-1.2.31/GOVERNANCE.md

@@ -0,0 +1,103 @@
+# Governance
+
+How boost makes decisions, who makes them, and what happens when people
+disagree. [MAINTAINERS.md](MAINTAINERS.md) is the companion: it lists who holds
+which role and which credential. This file is about the *process*.
+
+## The short version
+
+boost is a **single-maintainer project** run in the open. The lead maintainer
+decides; everything that shapes a decision — the roadmap, the quality gates, the
+reasoning behind a change — is public and arguable before it lands. That is a
+benevolent-dictator model, and naming it plainly is better than implying a
+committee that does not exist.
+
+This is stated as the current state, not an aspiration. It changes when a second
+maintainer is appointed under
+[MAINTAINERS.md](MAINTAINERS.md#becoming-a-maintainer), and this file changes
+with it.
+
+## How a decision gets made
+
+**1. Anyone may propose.** Open an issue, or open a pull request. There is no
+membership requirement and no form to fill in.
+
+**2. The argument happens in public, on the artifact.** Issues, pull requests,
+and the roadmap boards. A decision made in a private channel is not a decision
+this project recognises; if something was settled elsewhere, it gets written
+down in the open before it is acted on.
+
+**3. The gates decide what they can.** A large class of decisions is not a
+matter of opinion here — the change either passes the required checks or it does
+not. Coverage, mutation score, retrieval quality, the lint and type gates, the
+generated-file freshness checks: these are stated thresholds, and a maintainer
+does not get to wave one through. Changing a *threshold* is itself a decision
+that goes through this process, in its own pull request, with the measurement
+that justifies it.
+
+**4. The lead maintainer decides what the gates cannot.** Scope, design,
+priority, and whether a proposal fits the project at all. The decision is
+recorded where the work is: in the pull request, or as a roadmap card.
+
+**5. A "no" is recorded, not dropped.** The roadmap has a `declined` status
+precisely so a rejected proposal stops reading as backlog. Without it the same
+refuted question gets re-opened by the next person — or the next agent — who
+scans the board for work. If your proposal is declined you get the reason in
+writing, and it stays there.
+
+## Disagreements
+
+**With a decision.** Say so on the issue or pull request. Bring the thing that
+would change the answer: a measurement, a failing case, a constraint that was
+missed. This project changes its mind on evidence and says so when it does —
+several roadmap cards exist specifically to record that an earlier claim was
+wrong.
+
+**With the process, or with a person.** Conduct concerns go through the private
+reporting route in [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md), never a public
+issue.
+
+**When you cannot reach agreement.** With a single maintainer there is no appeal
+body, and pretending otherwise would be dishonest. The real backstop is the
+licence: boost is GPL-3.0 with full public history, so anyone who thinks the
+project is being run badly can fork it and prove it. That is a genuine check on
+the maintainer, not a consolation prize.
+
+## What is deliberately not decided by discussion
+
+Some things are settled by rule, and a pull request arguing the opposite gets
+declined on sight unless it changes the rule first:
+
+- **The runtime imports no third-party package.** Enforced by `import-linter`.
+- **Generated files are never hand-edited.** `registries.json`, both roadmap
+  boards, `commands.html`. Edit the source and regenerate.
+- **A suppressed finding needs a written argument**, naming what would have to
+  change for the suppression to stop being true. See
+  [`docs/dependencies.md`](docs/dependencies.md).
+- **A badge answer or a security claim must be checkable.** If the evidence
+  needs credentials nobody reading has, the claim gets softened to what *is*
+  checkable rather than asserted.
+
+## Roadmap and priority
+
+Priority is public and data-driven. Both boards are generated from one file per
+item under `docs/roadmap/items/`, so proposing work is a pull request adding a
+card, and claiming work is a pull request setting `status` and `owner` on one.
+Two people claiming different items touch different files and merge cleanly; two
+claiming the *same* item conflict on that one small file, which is the intended
+"already claimed" signal — first to merge wins.
+
+There is no private backlog. What is on the boards is what is planned.
+
+## Releases
+
+Every merge to `main` cuts a release. There is no release manager, no release
+meeting, and no window: the decision to release *is* the decision to merge.
+Consequences of that are set out in [SUPPORT.md](SUPPORT.md) — only the latest
+release is supported — and in
+[`docs/verifying-releases.md`](docs/verifying-releases.md), which is how you
+check that a release came from this repository.
+
+## Changing this document
+
+Like anything else: a pull request, argued in public, merged through the gates.

{boost_skill_cli-1.2.29 → boost_skill_cli-1.2.31}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.2.29
+Version: 1.2.31
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE
@@ -725,6 +725,7 @@ Dynamic: license-file
 [![Mutation score](https://img.shields.io/badge/mutation_score-%E2%89%A580%25_killed-blueviolet)](https://github.com/jonnyeclectic/boost/blob/main/scripts/mutation_gate.py)
 [![Platform](https://img.shields.io/badge/platform-macOS%20%7C%20Linux-lightgrey)](https://github.com/jonnyeclectic/boost/actions/workflows/ci.yml)
 [![OpenSSF Best Practices](https://www.bestpractices.dev/projects/14275/badge)](https://www.bestpractices.dev/projects/14275)
+[![OpenSSF Baseline](https://www.bestpractices.dev/projects/14275/baseline)](https://www.bestpractices.dev/projects/14275/baseline-2)
 [![License](https://img.shields.io/github/license/jonnyeclectic/boost)](LICENSE)
 
 **Homebrew for AI coding skills.** boost finds, installs, and version-tracks
@@ -1120,10 +1121,10 @@ as **Connected**. (Gemini only connects stdio servers in a trusted folder; run
 `gemini` once in the directory and accept the trust prompt if it shows
 `Disabled`.)
 
-## Claude Code hooks & the BMAD Method
+## Agent hooks & the BMAD Method
 
-`boost hooks` manages Claude Code hooks in `settings.json` at either scope —
-`--scope project` (`./.claude/settings.json`) or `--scope global`
+`boost hooks` manages hooks in `settings.json` at either scope — `--scope
+project` (`./.claude/settings.json`) or `--scope global`
 (`~/.claude/settings.json`). boost only ever touches hooks it created (tagged
 with a `# boost:<name>` marker in the command), never your own, and snapshots
 the prior file before each write.
@@ -1134,6 +1135,22 @@ boost hooks list
 boost hooks remove -n greet --scope project
 ```
 
+Gemini CLI has hooks too, behind `--host gemini` (`~/.gemini/settings.json`).
+The file shape is the same but two details are not, so boost handles both for
+you: its `timeout` is in milliseconds rather than seconds — `--timeout 10` is
+ten seconds on either host — and most event names differ. Pass whichever
+vocabulary you know and boost translates, saying which name it used:
+
+```bash
+boost hooks add PreToolUse --host gemini -c 'boost check' -n guard
+#   Claude's 'PreToolUse' is Gemini's 'BeforeTool' — using that
+boost hooks list          # both hosts, with a host column
+```
+
+`SubagentStop` and `SubagentStart` have no Gemini counterpart at all — it has
+no sub-agents — so boost refuses those rather than writing a hook that could
+never fire.
+
 ### BMAD autopilot
 
 `boost bmad on` is a one-time, global switch that puts the

{boost_skill_cli-1.2.29 → boost_skill_cli-1.2.31}/README.md

@@ -7,6 +7,7 @@
 [![Mutation score](https://img.shields.io/badge/mutation_score-%E2%89%A580%25_killed-blueviolet)](https://github.com/jonnyeclectic/boost/blob/main/scripts/mutation_gate.py)
 [![Platform](https://img.shields.io/badge/platform-macOS%20%7C%20Linux-lightgrey)](https://github.com/jonnyeclectic/boost/actions/workflows/ci.yml)
 [![OpenSSF Best Practices](https://www.bestpractices.dev/projects/14275/badge)](https://www.bestpractices.dev/projects/14275)
+[![OpenSSF Baseline](https://www.bestpractices.dev/projects/14275/baseline)](https://www.bestpractices.dev/projects/14275/baseline-2)
 [![License](https://img.shields.io/github/license/jonnyeclectic/boost)](LICENSE)
 
 **Homebrew for AI coding skills.** boost finds, installs, and version-tracks
@@ -402,10 +403,10 @@ as **Connected**. (Gemini only connects stdio servers in a trusted folder; run
 `gemini` once in the directory and accept the trust prompt if it shows
 `Disabled`.)
 
-## Claude Code hooks & the BMAD Method
+## Agent hooks & the BMAD Method
 
-`boost hooks` manages Claude Code hooks in `settings.json` at either scope —
-`--scope project` (`./.claude/settings.json`) or `--scope global`
+`boost hooks` manages hooks in `settings.json` at either scope — `--scope
+project` (`./.claude/settings.json`) or `--scope global`
 (`~/.claude/settings.json`). boost only ever touches hooks it created (tagged
 with a `# boost:<name>` marker in the command), never your own, and snapshots
 the prior file before each write.
@@ -416,6 +417,22 @@ boost hooks list
 boost hooks remove -n greet --scope project
 ```
 
+Gemini CLI has hooks too, behind `--host gemini` (`~/.gemini/settings.json`).
+The file shape is the same but two details are not, so boost handles both for
+you: its `timeout` is in milliseconds rather than seconds — `--timeout 10` is
+ten seconds on either host — and most event names differ. Pass whichever
+vocabulary you know and boost translates, saying which name it used:
+
+```bash
+boost hooks add PreToolUse --host gemini -c 'boost check' -n guard
+#   Claude's 'PreToolUse' is Gemini's 'BeforeTool' — using that
+boost hooks list          # both hosts, with a host column
+```
+
+`SubagentStop` and `SubagentStart` have no Gemini counterpart at all — it has
+no sub-agents — so boost refuses those rather than writing a hook that could
+never fire.
+
 ### BMAD autopilot
 
 `boost bmad on` is a one-time, global switch that puts the

{boost_skill_cli-1.2.29 → boost_skill_cli-1.2.31}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.2.29'
-__version_tuple__ = version_tuple = (1, 2, 29)
+__version__ = version = '1.2.31'
+__version_tuple__ = version_tuple = (1, 2, 31)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.2.29 → boost_skill_cli-1.2.31}/boost_cli/cli.py

@@ -125,7 +125,7 @@ COMMANDS = [
     ("schedule",    "cfg", "configuration", "Manage automatic skill-sync scheduling"),
     ("serve",       "cfg", "configuration", "Browse the catalogue in a browser: search, facets and a tap graph"),
     ("mcp",         "cfg", "configuration", "Register boost as an MCP server (Claude Code, Gemini CLI)"),
-    ("hooks",       "cfg", "hooks", "Manage Claude Code hooks (scope-aware) in settings.json"),
+    ("hooks",       "cfg", "hooks", "Manage agent hooks (Claude Code, Gemini CLI) in settings.json"),
     ("bmad",        "cfg", "bmad", "BMAD Method autopilot — `bmad on` routes every task to a persona"),
     ("self-update", "cfg", "configuration", "Update boost itself to the latest version"),
     # Team & Collaboration (6)

{boost_skill_cli-1.2.29 → boost_skill_cli-1.2.31}/boost_cli/commands/configuration.py

@@ -1329,9 +1329,19 @@ REGISTRY.register(
     "what this machine holds, not what exists, and a kind sitting at zero is a "
     "kind nothing here could have loaded. boost_search is what reads the "
     "registries themselves. "
-    "Read-only, instant, installs nothing — so unlike boost_search there is "
-    "no threshold worth applying: call it whenever you are about to plan "
-    "something. Planning from memory while "
+    # The cost clause names its own mechanism. Gemini CLI never delivers
+    # server `instructions` in interactive mode, so INSTRUCTIONS' "boost_list
+    # is free, call it whenever" is absent on that host and this declaration
+    # is the only place left to say it. "Instant" alone is a claim about the
+    # clock that an agent has to take on trust; "a local file read rather
+    # than a search" is the reason for it, checkable against what the tool
+    # obviously does, and it is why no threshold follows. boost_search's
+    # "10-15 seconds" stays out — that is the other tool's price, and this
+    # one does not pay it.
+    "Read-only and it installs nothing: a local file read rather than a "
+    "search, so it is instant and free. Unlike boost_search there is "
+    "therefore no threshold worth applying: call it whenever you are about "
+    "to plan something. Planning from memory while "
     "the answer already sits on disk is the one avoidable mistake here.",
     {"type": "object", "properties": {}},
     _tool_list)

boost_skill_cli-1.2.31/boost_cli/commands/hooks.py

@@ -0,0 +1,156 @@
+"""boost hooks — scope- and host-aware management of agent hooks in settings.json.
+
+    boost hooks add SessionStart --command 'boost bmad orient' --name bmad \
+        --scope global --matcher 'startup|resume|clear'
+    boost hooks add PreToolUse --host gemini -c 'boost check' -n guard
+    boost hooks list
+    boost hooks remove --name bmad
+
+Two hosts have hooks: Claude Code (`~/.claude/settings.json`, the default and
+unchanged) and Gemini CLI (`~/.gemini/settings.json`). What differs between
+them is a pure table in core/hookhost.py; this layer only picks a host, spells
+the event the way that host spells it, and reports what it did.
+
+Event names mostly differ, so `--host gemini` accepts either vocabulary and
+says which translation it applied. Two Claude events — SubagentStop and
+SubagentStart — have no Gemini counterpart at all, and are refused rather than
+silently dropped: a hook that looks installed and never fires is the failure
+mode worth being loud about.
+
+Only hooks boost created (tagged `# boost:<name>`) are ever touched; user hooks
+are left untouched. See core/claude_settings.py.
+"""
+from __future__ import annotations
+
+from .. import cliparse
+from ..core import claude_settings as cs
+from ..core import hookhost, journal
+from ..core import output as out
+from ..errors import BoostError
+
+
+def cmd_hooks(argv) -> int:
+    p = cliparse.parser(
+        prog="boost hooks",
+        description="Manage agent hooks (scope- and host-aware) in settings.json")
+    p.add_argument("action", choices=("add", "remove", "list"),
+                   help="add | remove | list")
+    p.add_argument("event", nargs="?",
+                   help="hook event, e.g. SessionStart (required for add)")
+    p.add_argument("--host", metavar="H", default=None,
+                   choices=(*hookhost.hosts(), "auto"),
+                   help="agent CLI whose settings.json to manage: %s "
+                        "(default: claude for add/remove, all of them for list)"
+                        % ", ".join(hookhost.hosts()))
+    p.add_argument("-c", "--command", help="command the hook runs (add)")
+    p.add_argument("-n", "--name", help="stable name used to tag & find the hook")
+    p.add_argument("-s", "--scope", choices=cs.SCOPES, default=None,
+                   help="settings scope (default: project; list shows both)")
+    p.add_argument("-m", "--matcher",
+                   help="Claude matcher, e.g. 'startup|resume|clear'")
+    p.add_argument("--timeout", type=int, default=10,
+                   help="hook timeout in seconds (default: 10)")
+    args = p.parse_args(argv)
+
+    if args.action == "list":
+        return _list(args.scope, args.host)
+    if args.action == "add":
+        return _add(args)
+    return _remove(args)
+
+
+def _list(scope, host) -> int:
+    rows = cs.list_all_hooks(scope, host=host)
+    if not rows:
+        out.info("no boost-managed hooks" + (" in %s scope" % scope if scope else ""))
+        return 0
+    out.table(
+        [(r["host"], r["scope"], r["event"], r["name"], r["matcher"] or "-",
+          r["command"]) for r in rows],
+        headers=("host", "scope", "event", "name", "matcher", "command"))
+    return 0
+
+
+def _write_host(requested) -> str:
+    """The single host an `add`/`remove` targets. Claude unless told otherwise.
+
+    `auto` is a read-only idea — fanning a write across every installed CLI is
+    not what someone asking for one hook meant — so it is rejected here rather
+    than quietly meaning "claude".
+    """
+    if requested in (None, ""):
+        return hookhost.CLAUDE
+    if requested == "auto":
+        raise BoostError("--host auto only makes sense for `hooks list`",
+                         hint="name one host: %s" % ", ".join(hookhost.hosts()))
+    return requested
+
+
+def _where(host: str, scope: str) -> str:
+    """How a write is named back to the user: "global", or "gemini/global".
+
+    Claude Code is the default host, so its scope stays unqualified — the
+    wording predates there being a second host and there is nothing to
+    disambiguate. A host the user had to ask for by name is worth repeating
+    back, because "removed 1 hook" is only reassuring if it says where from.
+    """
+    return scope if host == hookhost.CLAUDE else "%s/%s" % (host, scope)
+
+
+def _native_event(host: str, event: str) -> str:
+    """`event` as `host` spells it, saying so, or refusing if it cannot."""
+    native = hookhost.translate(host, event)
+    if native is None:
+        raise BoostError(
+            "'%s' has no %s counterpart" % (event, hookhost.label(host)),
+            hint="%s has no sub-agents; its events are: %s"
+                 % (hookhost.label(host), ", ".join(hookhost.events(host))))
+    if native != event:
+        out.info("Claude's '%s' is %s's '%s' — using that"
+                 % (event, hookhost.event_label(host), native))
+    return native
+
+
+def _add(args) -> int:
+    if not args.event:
+        raise BoostError("hooks add needs an EVENT",
+                         hint="e.g. boost hooks add SessionStart -c '<cmd>' -n <name>")
+    if not args.command:
+        raise BoostError("hooks add needs --command",
+                         hint="the shell command Claude should run for this hook")
+    if not args.name:
+        raise BoostError("hooks add needs --name",
+                         hint="a stable name so the hook can be removed later")
+    scope = args.scope or "project"
+    host = _write_host(args.host)
+    event = _native_event(host, args.event)
+    if event not in hookhost.events(host):
+        out.warn("'%s' is not a known %s hook event — adding anyway"
+                 % (event, hookhost.event_label(host)))
+    cs.add_hook(scope, event, args.name, args.command,
+                matcher=args.matcher, timeout=args.timeout, host=host)
+    journal.log("hook-add", args.name, scope=scope, event=event, host=host)
+    out.ok("added %s hook '%s' (%s) → %s"
+           % (event, args.name, _where(host, scope), args.command))
+    out.dim("  settings: %s" % cs.settings_path(scope, host=host))
+    return 0
+
+
+def _remove(args) -> int:
+    if not args.name:
+        raise BoostError("hooks remove needs --name",
+                         hint="the name you gave the hook when adding it")
+    scope = args.scope or "project"
+    host = _write_host(args.host)
+    events = ((_native_event(host, args.event),) if args.event
+              else hookhost.events(host))
+    removed = sum(cs.remove_hook(scope, ev, args.name, host=host)
+                  for ev in events)
+    journal.log("hook-remove", args.name, scope=scope, host=host)
+    if removed:
+        out.ok("removed %d hook(s) named '%s' (%s)"
+               % (removed, args.name, _where(host, scope)))
+    else:
+        out.warn("no boost hook named '%s' in %s scope"
+                 % (args.name, _where(host, scope)))
+    return 0

{boost_skill_cli-1.2.29 → boost_skill_cli-1.2.31}/boost_cli/commands/quality.py

@@ -535,6 +535,19 @@ def cmd_doctor(argv):
                  "left alone; yours to remove or repair"
                  % (len(foreign), _s(len(foreign))))
 
+    for dup in store.duplicate_discovery():
+        # An agent that reads the canonical store natively, holding its own
+        # entry for a skill that store already carries. Boost did not put it
+        # there — it never links into a native-store agent — but the agent
+        # loads the same skill from two discovery tiers and says so on every
+        # session, so a health check that stayed quiet about it would be
+        # describing a machine the user is not looking at.
+        bad("skill %s is discoverable twice by %s — %s leads to %s, which it "
+            "already reads natively; remove the duplicate with "
+            "`boost heal --prune-duplicates`"
+            % (dup.name, agents.display_name(dup.agent), _tilde(dup.path),
+               _tilde(dup.target)), wrap=True)
+
     for adir in enabled.values():
         if adir.is_dir() and not os.access(str(adir), os.W_OK):
             bad("agent dir %s is not writable" % _tilde(adir))
@@ -854,6 +867,9 @@ def cmd_heal(argv):
         description="Self-diagnose & repair the boost environment")
     ap.add_argument("--dry-run", action="store_true",
                     help="show repairs without applying them")
+    ap.add_argument("--prune-duplicates", action="store_true",
+                    help="remove symlinks in a native-store agent's skills dir "
+                         "that lead back into the canonical store")
     args = ap.parse_args(argv)
     dry = args.dry_run
     actions: list[str] = []
@@ -903,6 +919,30 @@ def cmd_heal(argv):
             out.ok(msg.replace(str(paths.home()), "~"))
             actions.append(msg)
 
+    # Opt-in, unlike everything above it. The rest of `heal` repairs what boost
+    # itself created; these entries boost did not create, so deleting one on a
+    # plain `boost heal` would be silently removing another tool's file. Named
+    # every run so the flag is discoverable from the command that would use it.
+    duplicates = store.duplicate_discovery()
+    declined_duplicates = bool(duplicates) and not args.prune_duplicates
+    for dup in duplicates:
+        label = "%s → %s (%s)" % (_tilde(dup.path), _tilde(dup.target), dup.agent)
+        if not args.prune_duplicates:
+            out.info("duplicate skill discovery %s — %s reads the store "
+                     "natively; remove it with `boost heal --prune-duplicates`"
+                     % (label, agents.display_name(dup.agent)), wrap=True)
+        elif dry:
+            out.info("would remove duplicate skill discovery %s" % label)
+            actions.append("duplicate %s" % dup.path)
+        elif store.remove_duplicate_discovery(dup):
+            out.ok("removed duplicate skill discovery %s" % label)
+            actions.append("duplicate %s" % dup.path)
+        else:
+            # Re-gated at the point of deletion, so a real directory or a link
+            # repointed since the scan lands here rather than being removed.
+            out.warn("%s is no longer a symlink into the store — left alone"
+                     % _tilde(dup.path))
+
     for tap in registry.list_taps():
         if not tap.is_cloned:
             out.warn("tap %s not cloned — skipped (run `boost update`)" % tap.name)
@@ -929,7 +969,11 @@ def cmd_heal(argv):
         actions.append("rotate")
 
     if not actions:
-        out.ok("nothing to heal")
+        # A duplicate this run declined to prune is something `heal` saw, can
+        # fix, and deliberately left. A bare "nothing to heal" printed under
+        # the line offering the flag contradicts it.
+        out.ok("nothing to heal automatically"
+               if declined_duplicates else "nothing to heal")
     elif not dry:
         journal.log("heal", "%d actions" % len(actions))
     return 0