boost-skill-cli 1.2.47__tar.gz → 1.2.49__tar.gz

{boost_skill_cli-1.2.47 → boost_skill_cli-1.2.49}/CLAUDE.md

@@ -185,7 +185,16 @@ line coverage. Target `boost_cli/core` behavior with assertions, not just import
   `HOME`/`BOOST_HOME`; tests point them at a tempdir. In zsh, one-line chains
   like `export A=$(...) B=$A/x` leave `B` broken — use separate `export`
   statements.
-- **Versioning is setuptools-scm from git tags.** There is no `__version__`
+- **Versioning is setuptools-scm from git tags.** **Only `vX.Y.Z` tags count**, and
+  two settings say so: `git_describe_command`'s `--match v[0-9]*` decides which
+  tag is *found* and `tag_regex` decides how it is *parsed*. Both are load-
+  bearing since the repo gained a deliberate non-version tag — `shards-latest`,
+  the rolling release hosting the vector shards. At defaults, `git describe`
+  returned `shards-latest-1-g82c3e6a`, the build called itself
+  `vshards-latest-…`, and `boost self-update` then reported "already up to
+  date" against a newer PyPI release, because it compares version tuples and
+  that string parses as none. A silent wrong answer in the command whose job is
+  to detect being behind. There is no `__version__`
   constant and `boost_cli/_version.py` is generated + gitignored. Don't hardcode
   or assert exact versions; version tests are shape-only (`^boost \S+$`). The
   publish workflow filename must stay `publish.yml` (PyPI Trusted Publisher
@@ -435,6 +444,33 @@ of the three item kinds (see Non-obvious rules above); `core/store.py` owns
 install, uninstall and sync — copying into the canonical store, symlinking into
 each agent's skills dir, and updating the lock file.
 
+- **A tap pin lives in `config.json`, and `boost update` is what makes it real.**
+  `boost tap --at <sha>` used to check a commit out and record nothing, so the
+  next `boost update` reset the clone to the default branch — measured on a
+  two-commit fixture: tapped at `fb61736`, updated, `6206d22`. That silently
+  invalidates any shard imported for the old commit (stale vectors, still
+  present, no error), which is also the reason **search must never refresh taps
+  in the background**: `_hint_stale_taps` reads one mtime
+  (`paths.tap_refresh_marker`, stamped by `registry.update`) and prints one
+  line rather than fetching. `registry.update` skips a pinned tap; `--force`
+  moves it *and* drops the pin, because deciding to move a tap is deciding to
+  stop holding it still. After any tap actually moves, `pkg._resync_vectors`
+  asks the manifest whether a shard exists for the new commit — importing it
+  costs a download instead of an hour of CPU — and says plainly when one does
+  not.
+
+- **The shard matrix is packed, not sliced, and 256 is a hard ceiling.**
+  GitHub runs at most 256 matrix jobs per workflow, so `shards.yml` cannot take
+  one job per registry once the scope is the 463-registry catalogue — the run
+  fails before a job starts. `scripts/shard_plan.py` bin-packs by the measured
+  `est_items` (longest-processing-time-first), which matters because cost is
+  uneven: the largest catalogued registry is 880 items against a median of 30,
+  so slicing puts several giants in one job while others idle, against a
+  6-hour per-job ceiling. Packing is deterministic on purpose — a rerun that
+  repacked differently would re-embed registries whose shards were already
+  published. A matrix entry is a **space-separated list**, split in Python
+  inside the job, never by shell word-splitting.
+
 - **A published shard is only importable while three things match, and every
   mismatch is silent if waved through.** `core/shards.py` fetches
   `manifest.json` from a rolling `shards-latest` **prerelease** on this repo —

{boost_skill_cli-1.2.47/boost_skill_cli.egg-info → boost_skill_cli-1.2.49}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.2.47
+Version: 1.2.49
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License-Expression: Apache-2.0
@@ -186,8 +186,21 @@ those vectors. Embedding is ~1.2 s/chunk on CPU — hours for a real corpus —
 and importing the same rows takes 0.12 s, so the difference between the two is
 the difference between semantic search being available and being reachable.
 
+Want everything? `boost quickstart --catalog` taps all 463 catalogued
+registries — 2 min 10 s now that clones run in parallel — and fetches vectors
+for every one that has a published shard.
+
 Already tapped? `boost reindex --fetch-shards` does the download half alone,
 and `boost reindex --dense` embeds locally whatever has no published shard.
+
+Because vectors are keyed to a registry's commit, `quickstart` **pins** each tap
+it fetches vectors for, and `boost update` skips a pinned tap rather than moving
+it out from under them (`--force` moves it anyway and drops the pin). When a tap
+does move, boost checks whether a newer shard exists for the new commit and
+imports it; if none does, it says so instead of leaving stale vectors looking
+fresh. `boost search` never refreshes taps behind your back — it prints one line
+when they are more than two weeks old and leaves the fetching to
+`boost update --taps-only`.
 Every download is checked against the sha256 in the manifest and refused on a
 mismatch, and shards for a registry that has moved since publication are
 refused rather than merged — stale vectors would otherwise look fresh forever.

{boost_skill_cli-1.2.47 → boost_skill_cli-1.2.49}/README.md

@@ -144,8 +144,21 @@ those vectors. Embedding is ~1.2 s/chunk on CPU — hours for a real corpus —
 and importing the same rows takes 0.12 s, so the difference between the two is
 the difference between semantic search being available and being reachable.
 
+Want everything? `boost quickstart --catalog` taps all 463 catalogued
+registries — 2 min 10 s now that clones run in parallel — and fetches vectors
+for every one that has a published shard.
+
 Already tapped? `boost reindex --fetch-shards` does the download half alone,
 and `boost reindex --dense` embeds locally whatever has no published shard.
+
+Because vectors are keyed to a registry's commit, `quickstart` **pins** each tap
+it fetches vectors for, and `boost update` skips a pinned tap rather than moving
+it out from under them (`--force` moves it anyway and drops the pin). When a tap
+does move, boost checks whether a newer shard exists for the new commit and
+imports it; if none does, it says so instead of leaving stale vectors looking
+fresh. `boost search` never refreshes taps behind your back — it prints one line
+when they are more than two weeks old and leaves the fetching to
+`boost update --taps-only`.
 Every download is checked against the sha256 in the manifest and refused on a
 mismatch, and shards for a registry that has moved since publication are
 refused rather than merged — stale vectors would otherwise look fresh forever.

{boost_skill_cli-1.2.47 → boost_skill_cli-1.2.49}/boost_cli/__init__.py

@@ -21,8 +21,16 @@ def _detect_version() -> str:
         import subprocess
         from pathlib import Path
         root = Path(__file__).resolve().parent.parent
+        # `--match v[0-9]*`, exactly as pyproject's git_describe_command:
+        # the repo carries a deliberate non-version tag (`shards-latest`, the
+        # rolling release hosting the vector shards), and without the match
+        # this fallback served `shards-latest-3-g…` as the version — which
+        # parses as no version at all, so `self-update` compared nothing and
+        # answered "already up to date" while a newer release existed.
+        # `--always` still yields a bare SHA when no version tag is reachable.
         proc = subprocess.run(
-            ["git", "-C", str(root), "describe", "--tags", "--always", "--dirty"],
+            ["git", "-C", str(root), "describe", "--tags", "--always",
+             "--dirty", "--match", "v[0-9]*"],
             capture_output=True, text=True, timeout=3)
         described = proc.stdout.strip()
         if proc.returncode == 0 and described:

{boost_skill_cli-1.2.47 → boost_skill_cli-1.2.49}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.2.47'
-__version_tuple__ = version_tuple = (1, 2, 47)
+__version__ = version = '1.2.49'
+__version_tuple__ = version_tuple = (1, 2, 49)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.2.47 → boost_skill_cli-1.2.49}/boost_cli/commands/discovery.py

@@ -141,6 +141,9 @@ def cmd_search(argv):
             "no matches for %r" % query,
             "try `boost discover %s` to search all of GitHub" % query))
         _hint_semantic_search(engine)
+        # Especially here: "no matches" is exactly the answer an out-of-date
+        # tap set produces, and the user has no other way to suspect it.
+        _hint_stale_taps()
         return 0
     # The CLI's long-standing wording for the BM25 engine differs from the label
     # rag/eval use ("BM25 full-content"), and both are load-bearing: the latter
@@ -180,6 +183,7 @@ def cmd_search(argv):
     if use_rag:
         _note_stem_expansions(query)
     _hint_semantic_search(engine)
+    _hint_stale_taps()
     return 0
 
 
@@ -200,6 +204,28 @@ def _note_stem_expansions(query: str) -> None:
         max(0, out.term_width() - 2)), "muted"))
 
 
+def _hint_stale_taps() -> None:
+    """Mention old tap clones. One `stat`, and never a network call.
+
+    Search deliberately does not refresh the taps themselves. A refresh is a
+    `git fetch` per tap — ~1.6 s each, minutes across a real install — so doing
+    it inline would turn a sub-second command into a wait, and doing it in the
+    background would mean unannounced network egress plus writes to the very
+    caches the search is reading. Worse, a tap's commit is load-bearing for
+    dense vectors, so a silent update would strand imported shards as stale.
+
+    So: say it, do not do it. The marker's mtime answers "how long ago" for the
+    price of one stat, and a machine that has never refreshed says nothing at
+    all rather than inventing an age.
+    """
+    age = registry.refresh_age_days()
+    if age is None or age < registry.STALE_TAPS_DAYS:
+        return
+    out.info(out.role(
+        "taps last refreshed %d days ago — `boost update --taps-only`"
+        % int(age), "muted"))
+
+
 def _hint_semantic_search(engine: str) -> None:
     """Say that a better engine exists, when BM25 answered alone.
 

{boost_skill_cli-1.2.47 → boost_skill_cli-1.2.49}/boost_cli/commands/pkg.py

@@ -31,6 +31,7 @@ from ..core import (
     lockfile,
     paths,
     projectlock,
+    rag,
     registry,
     resolve,
     scopes,
@@ -835,6 +836,48 @@ def _update_materialized(kind: str, installed: dict[str, dict], results) -> int:
     return n
 
 
+def _resync_vectors(moved: list[str]) -> None:
+    """Keep prebuilt vectors honest after the taps underneath them move.
+
+    A tap's commit is load-bearing for dense search: `dense.build` marks a tap
+    "reused" per commit and `import_shard` refuses a shard built for another
+    one. So an update that moves a tap leaves its vectors stale *but present* —
+    the failure mode that looks like nothing at all, and the reason auto-
+    updating taps in the background would quietly undo a shard import.
+
+    Two outcomes are worth the network: a newer shard exists for the commit the
+    tap just moved to, in which case importing it costs a download instead of
+    an hour of CPU; or one does not, in which case the honest thing is to say
+    the vectors are now stale and name the command that rebuilds them.
+    """
+    if not moved:
+        return
+    from ..core import dense, shards
+    if not dense.ready():
+        return                      # nothing embedded here to invalidate
+    try:
+        manifest = shards.fetch_manifest()
+    except BoostError:
+        # Offline, or no manifest published. The vectors are still stale, and
+        # saying so without the remedy we could not check for is enough.
+        out.info(out.role("prebuilt vectors for %d refreshed tap(s) are now "
+                          "stale — `boost reindex --dense` rebuilds them"
+                          % len(moved), "muted"))
+        return
+    commits = rag._tap_commits()
+    by_name = {t.name: commits.get(t.safe_name, "")
+               for t in registry.list_taps() if t.name in moved}
+    got = [r for r in shards.sync(list(by_name), by_name, manifest=manifest)
+           if r["status"] == "imported"]
+    if got:
+        out.ok("re-imported prebuilt vectors for %d tap(s)" % len(got))
+    left = len(moved) - len(got)
+    if left:
+        out.info(out.role("%d refreshed tap(s) have no matching shard yet — "
+                          "their vectors are stale until "
+                          "`boost reindex --dense`" % left, "muted"))
+
+
 def cmd_update(argv: list[str]) -> int:
     ap = cliparse.parser(prog="boost update",
                                  description="Sync taps or update installed skills")
@@ -849,14 +892,23 @@ def cmd_update(argv: list[str]) -> int:
     # sys.argv, so this makes the printed advice true rather than adding a path.
     ap.add_argument("-y", "--yes", action="store_true",
                     help="skip the confirmation prompt")
+    ap.add_argument("--force", action="store_true",
+                    help="move pinned taps too, clearing their pin")
     args = ap.parse_args(argv)
-    results, failures = registry.update(args.tap or None)
+    results, failures = registry.update(args.tap or None, force=args.force)
     if not results and not failures:
         out.info("no taps configured — start with `boost tap --defaults`")
         return 0
+    moved = []
     for tname, summary in results.items():
-        catalog.rebuild_tap(registry.get(tname))
+        if "skipped" not in summary:
+            catalog.rebuild_tap(registry.get(tname))
+        # "abc1234 → def5678" is a tap whose tree changed; "already up to date"
+        # and "pinned at ..." are not. Only the first invalidates vectors.
+        if "→" in summary:
+            moved.append(tname)
         out.ok("%s: %s" % (tname, summary))
+    _resync_vectors(moved)
     # Report the dead ones by name, after the successes, so a broken upstream
     # reads as one line of bad news rather than as the whole command failing.
     for tname, err in failures.items():

{boost_skill_cli-1.2.47 → boost_skill_cli-1.2.49}/boost_cli/commands/quickstart.py

@@ -32,19 +32,43 @@ from ..core import output as out
 from ..errors import BoostError
 
 
-def _tap_defaults(pins: dict[str, dict], dry_run: bool) -> list[str]:
-    """Tap the default registries, pinned to a shard's commit when one exists.
+def _selection(catalog_scope: bool) -> list[dict]:
+    """The registries quickstart will tap: the seven defaults, or all of them.
+
+    `--catalog` exists because "search everything" is a real ask and the two
+    costs that used to make it unreasonable are gone: tapping 463 registries is
+    2 min 10 s now that clones run in parallel, and their vectors are a
+    download rather than an hour of CPU.
+    """
+    if not catalog_scope:
+        return [d.copy() for d in config.DEFAULT_TAPS]
+    return [{"name": e["name"], "url": e["url"]}
+            for e in config.load_registry_catalog()
+            if not e.get("list_only") and e.get("name") and e.get("url")]
+
+
+def _tap_defaults(selection: list[dict], pins: dict[str, dict],
+                  dry_run: bool) -> list[str]:
+    """Tap the selected registries, pinned to a shard's commit when one exists.
 
     Returns the tap names that are configured afterwards, tapped here or not.
     Pinning is the whole point: tapping HEAD and then fetching a shard is the
     ordering that produces a commit mismatch on every registry that moved since
     the last shard run.
     """
-    names = [str(d["name"]) for d in config.DEFAULT_TAPS]
+    names = [str(d["name"]) for d in selection]
     commits = {name: str(pins[name].get("commit")) for name in names
                if name in pins}
     if dry_run:
         existing = {t.name for t in registry.list_taps()}
+        pending = [n for n in names if n not in existing]
+        # Over 463 registries a line each is a wall of text, so past a handful
+        # the dry run reports the shape instead of the list.
+        if len(pending) > 12:
+            out.info("would tap %d registries (%d pinned to a published "
+                     "shard's commit)"
+                     % (len(pending), sum(1 for n in pending if n in commits)))
+            return names
         for name in names:
             if name in existing:
                 out.info(out.role("%s already tapped" % name, "muted"))
@@ -56,7 +80,7 @@ def _tap_defaults(pins: dict[str, dict], dry_run: bool) -> list[str]:
     # for work that takes ~2 s done together, and the first thing a new user
     # sees should not be a progress bar.
     with spin.Spinner("tapping %d registries" % len(names)):
-        results = registry.add_many([str(d["url"]) for d in config.DEFAULT_TAPS],
+        results = registry.add_many([str(d["url"]) for d in selection],
                                     curated=True, pins=commits)
     for res in results:
         name = res["name"]
@@ -104,10 +128,13 @@ def _report(results: list[dict]) -> None:
 
 
 def cmd_quickstart(argv) -> int:
-    """boost quickstart [--no-vectors] [--dry-run]"""
+    """boost quickstart [--catalog] [--no-vectors] [--dry-run]"""
     p = cliparse.parser(
         prog="boost quickstart",
         description="Tap the starter registries and load prebuilt vectors")
+    p.add_argument("--catalog", action="store_true",
+                   help="tap every catalogued registry, not just the 7 "
+                        "starters, and fetch vectors for all of them")
     p.add_argument("--no-vectors", action="store_true",
                    help="set up taps and keyword search only, skip shards")
     p.add_argument("--dry-run", action="store_true",
@@ -129,7 +156,8 @@ def cmd_quickstart(argv) -> int:
             out.warn("no published shards: %s" % exc.message)
             manifest = None
 
-    names = _tap_defaults(pins, args.dry_run)
+    selection = _selection(args.catalog)
+    names = _tap_defaults(selection, pins, args.dry_run)
     if args.dry_run:
         planned = [n for n in names if n in pins] if manifest else []
         out.info("would build the keyword index, then import %d shard(s)"

{boost_skill_cli-1.2.47 → boost_skill_cli-1.2.49}/boost_cli/commands/taps.py

@@ -226,7 +226,8 @@ def cmd_taps(argv) -> int:
         skills = catalog.load_tap(tap)
         total += len(skills)
         taps.append({"name": tap.name, "url": tap.url, "curated": tap.curated,
-                     "skills": len(skills), "updated": _tap_updated(tap)})
+                     "skills": len(skills), "updated": _tap_updated(tap),
+                     "pin": tap.pin})
     if args.json:
         print(json.dumps(taps, indent=2))
         return 0
@@ -234,7 +235,12 @@ def cmd_taps(argv) -> int:
         out.info("no taps configured")
         out.info(out.role("add the recommended registries with `boost tap --defaults`", "muted"))
         return 0
-    rows = [(t["name"], str(t["skills"]), t["updated"],
+    # A pinned tap reads as its commit rather than its date: the date of a
+    # clone held still is not what the user needs to know about it, and a tap
+    # that `boost update` deliberately skips should say why on the line the
+    # user is already reading.
+    rows = [(t["name"], str(t["skills"]),
+             "@%s" % str(t["pin"])[:7] if t["pin"] else t["updated"],
              "★" if t["curated"] else "", out.role(_tilde(t["url"]), "muted"))
             for t in taps]
     out.table(rows, headers=("NAME", "SKILLS", "UPDATED", "", "URL"))

{boost_skill_cli-1.2.47 → boost_skill_cli-1.2.49}/boost_cli/core/paths.py

@@ -103,6 +103,16 @@ def state_dir() -> Path:
     return boost_home() / "state"
 
 
+def tap_refresh_marker() -> Path:
+    """File whose mtime records when the taps were last refreshed.
+
+    An mtime rather than a JSON field: the only question asked of it is "how
+    long ago", on the search path, where one `stat` is affordable and parsing
+    anything is not.
+    """
+    return state_dir() / "last-tap-refresh"
+
+
 def snapshots_dir() -> Path:
     """Return the directory for ``snap-*`` store snapshot tarballs."""
     return state_dir() / "snapshots"

{boost_skill_cli-1.2.47 → boost_skill_cli-1.2.49}/boost_cli/core/registry.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 
 import difflib
 import os
+import time
 from concurrent.futures import ThreadPoolExecutor
 from contextlib import suppress
 from dataclasses import dataclass
@@ -20,6 +21,12 @@ class Tap:
     name: str          # "anthropics/skills" or a short alias
     url: str           # https URL or local path
     curated: bool = False
+    #: A 40-character commit this tap is held at, or "" for "track the default
+    #: branch". A pin is durable *because it is recorded here*: `tap --at`
+    #: checked a commit out and nothing remembered, so the next `boost update`
+    #: moved the clone to HEAD — silently invalidating any prebuilt vectors
+    #: imported for that commit, which is the whole reason the pin exists.
+    pin: str = ""
 
     @property
     def safe_name(self) -> str:
@@ -131,7 +138,8 @@ def list_taps() -> list[Tap]:
     taps = config.get("taps", []) or []
     if not isinstance(taps, list):
         return []
-    return [Tap(name=t["name"], url=t.get("url", ""), curated=bool(t.get("curated")))
+    return [Tap(name=t["name"], url=t.get("url", ""),
+                curated=bool(t.get("curated")), pin=str(t.get("pin") or ""))
             for t in taps if isinstance(t, dict) and t.get("name")]
 
 
@@ -203,9 +211,12 @@ def add(spec: str, curated: bool = False, at: str | None = None) -> Tap:
             hint="add its key with `boost trust add <name> <key>`, "
                  "or relax `boost policy set require_signed_taps false`")
     cfg = config.load()
-    cfg.setdefault("taps", []).append(
-        {"name": name, "url": url, "curated": curated})
+    row = {"name": name, "url": url, "curated": curated}
+    if at:
+        row["pin"] = at
+    cfg.setdefault("taps", []).append(row)
     config.save(cfg)
+    tap.pin = at or ""
     return tap
 
 
@@ -336,8 +347,12 @@ def add_many(specs: list[str], curated: bool = False,
         cfg = config.load()
         rows = cfg.setdefault("taps", [])
         for r in fresh:
-            rows.append({"name": r["name"], "url": r["url"],
-                         "curated": curated})
+            row = {"name": r["name"], "url": r["url"], "curated": curated}
+            pin = pins.get(r["name"])
+            if pin:
+                row["pin"] = pin
+                r["tap"].pin = pin
+            rows.append(row)
         config.save(cfg)
     # First occurrence, not last: a dict comprehension over `specs` keeps the
     # LAST index for a repeated spec, which pushed the duplicate — and so its
@@ -352,6 +367,58 @@ def add_many(specs: list[str], curated: bool = False,
     return results
 
 
+#: How long a tap set may go unrefreshed before `boost search` mentions it.
+#: Two weeks rather than days: registries move slowly, and a hint that fires
+#: every other search is one users learn to read past.
+STALE_TAPS_DAYS = 14
+
+
+def mark_refreshed() -> None:
+    """Stamp "the taps were refreshed just now"; never fails a refresh."""
+    with suppress(OSError):
+        paths.ensure_dirs()
+        paths.tap_refresh_marker().write_text("", encoding="utf-8")
+
+
+def refresh_age_days() -> float | None:
+    """Days since the last tap refresh, or None when nothing has recorded one.
+
+    None is not zero and not infinity: on a machine that has never run
+    `boost update` there is nothing to report, and inventing an age would make
+    every fresh install nag about staleness on its first search.
+    """
+    marker = paths.tap_refresh_marker()
+    try:
+        age = time.time() - marker.stat().st_mtime
+    except OSError:
+        return None
+    return max(0.0, age / 86400.0)
+
+
+def pin(name: str, commit: str) -> Tap:
+    """Record `commit` as the tap's pin, so `update` leaves it alone."""
+    tap = get(name)
+    cfg = config.load()
+    for row in cfg.get("taps", []) or []:
+        if isinstance(row, dict) and row.get("name") == tap.name:
+            row["pin"] = commit
+    config.save(cfg)
+    tap.pin = commit
+    return tap
+
+
+def unpin(name: str) -> Tap:
+    """Drop a tap's pin so it tracks its default branch again."""
+    tap = get(name)
+    cfg = config.load()
+    for row in cfg.get("taps", []) or []:
+        if isinstance(row, dict) and row.get("name") == tap.name:
+            row.pop("pin", None)
+    config.save(cfg)
+    tap.pin = ""
+    return tap
+
+
 def remove(name: str) -> Tap:
     """Deregister a tap and delete its clone and cache file.
 
@@ -374,9 +441,14 @@ def remove(name: str) -> Tap:
 WHEEL_SCHEME = "builtin:"
 
 
-def update(name: str | None = None) -> tuple[dict, dict]:
+def update(name: str | None = None,
+           force: bool = False) -> tuple[dict, dict]:
     """git-pull one tap (or all). Returns ``({name: summary}, {name: error})``.
 
+    **A pinned tap is skipped** unless ``force``, which also clears the pin —
+    an update that silently moved a pinned clone is what made `tap --at` a
+    suggestion rather than a guarantee.
+
     **A named tap still raises.** ``boost update sometap`` is a request about
     that one tap, so its failure is the answer to the question asked.
 
@@ -395,6 +467,14 @@ def update(name: str | None = None) -> tuple[dict, dict]:
     results: dict = {}
     failures: dict = {}
     for tap in targets:
+        if tap.pin and not force:
+            # A pinned tap is held at one commit on purpose: prebuilt vectors
+            # are keyed to it, and moving the clone would make them stale while
+            # still present — the failure that looks like nothing at all. Not
+            # an error, because "update everything" over 400 taps should not
+            # fail because three are pinned.
+            results[tap.name] = "pinned at %s (skipped)" % tap.pin[:7]
+            continue
         try:
             if tap.url.startswith(WHEEL_SCHEME):
                 # boost's own tap arrives with the wheel, so there is no remote
@@ -414,6 +494,11 @@ def update(name: str | None = None) -> tuple[dict, dict]:
                 results[tap.name] = "cloned"
             else:
                 results[tap.name] = gitutil.pull(tap.path)
+                if tap.pin:
+                    # `--force` is a decision to stop holding this tap still,
+                    # so the pin goes with the move rather than silently
+                    # re-applying on the next run.
+                    unpin(tap.name)
         except BoostError as err:
             if name:
                 raise
@@ -421,4 +506,9 @@ def update(name: str | None = None) -> tuple[dict, dict]:
             # says; git's own first line already carries the URL or path. See
             # gitutil._git_error for why that line is now the one we show.
             failures[tap.name] = err.message
+    if results:
+        # Stamped on any successful sweep, including one where every tap was
+        # already current: "refreshed" is about having asked, not about having
+        # found something.
+        mark_refreshed()
     return results, failures

{boost_skill_cli-1.2.47 → boost_skill_cli-1.2.49/boost_skill_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.2.47
+Version: 1.2.49
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License-Expression: Apache-2.0
@@ -186,8 +186,21 @@ those vectors. Embedding is ~1.2 s/chunk on CPU — hours for a real corpus —
 and importing the same rows takes 0.12 s, so the difference between the two is
 the difference between semantic search being available and being reachable.
 
+Want everything? `boost quickstart --catalog` taps all 463 catalogued
+registries — 2 min 10 s now that clones run in parallel — and fetches vectors
+for every one that has a published shard.
+
 Already tapped? `boost reindex --fetch-shards` does the download half alone,
 and `boost reindex --dense` embeds locally whatever has no published shard.
+
+Because vectors are keyed to a registry's commit, `quickstart` **pins** each tap
+it fetches vectors for, and `boost update` skips a pinned tap rather than moving
+it out from under them (`--force` moves it anyway and drops the pin). When a tap
+does move, boost checks whether a newer shard exists for the new commit and
+imports it; if none does, it says so instead of leaving stale vectors looking
+fresh. `boost search` never refreshes taps behind your back — it prints one line
+when they are more than two weeks old and leaves the fetching to
+`boost update --taps-only`.
 Every download is checked against the sha256 in the manifest and refused on a
 mismatch, and shards for a registry that has moved since publication are
 refused rather than merged — stale vectors would otherwise look fresh forever.

{boost_skill_cli-1.2.47 → boost_skill_cli-1.2.49}/boost_skill_cli.egg-info/SOURCES.txt

@@ -553,6 +553,7 @@ scripts/publish_shards.py
 scripts/release_guard.py
 scripts/release_preflight.py
 scripts/serve_docs.py
+scripts/shard_plan.py
 style/README.md
 style/boost.css
 style/boost.js
@@ -599,6 +600,7 @@ tests/functional/test_cli_pane_width.py
 tests/functional/test_cli_pkg.py
 tests/functional/test_cli_quality.py
 tests/functional/test_cli_quickstart.py
+tests/functional/test_cli_tap_pins.py
 tests/functional/test_cli_taps.py
 tests/functional/test_cli_team.py
 tests/functional/test_everyday_loop.py
@@ -775,6 +777,7 @@ tests/unit/test_secretscan.py
 tests/unit/test_selfupdate.py
 tests/unit/test_serve.py
 tests/unit/test_serve_docs.py
+tests/unit/test_shard_plan.py
 tests/unit/test_shards.py
 tests/unit/test_shards_matrix.py
 tests/unit/test_smoke_covers_every_command.py
@@ -786,6 +789,7 @@ tests/unit/test_store.py
 tests/unit/test_store_materialize.py
 tests/unit/test_sync_blocked_links.py
 tests/unit/test_sync_repairs_gutted_skill.py
+tests/unit/test_tap_pins.py
 tests/unit/test_token_parity.py
 tests/unit/test_toolchain_lock.py
 tests/unit/test_trustaudit.py
@@ -793,6 +797,7 @@ tests/unit/test_typosquat.py
 tests/unit/test_updatediff.py
 tests/unit/test_util.py
 tests/unit/test_version.py
+tests/unit/test_version_tags.py
 tests/unit/test_vex.py
 tests/unit/test_visual_harness_flags.py
 tests/unit/test_workflow_concurrency.py