boost-skill-cli 1.2.4__tar.gz → 1.2.6__tar.gz

{boost_skill_cli-1.2.4 → boost_skill_cli-1.2.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.2.4
+Version: 1.2.6
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.2.4 → boost_skill_cli-1.2.6}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.2.4'
-__version_tuple__ = version_tuple = (1, 2, 4)
+__version__ = version = '1.2.6'
+__version_tuple__ = version_tuple = (1, 2, 6)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.2.4 → boost_skill_cli-1.2.6}/boost_cli/core/registry.py

@@ -37,6 +37,29 @@ class Tap:
         return self.path.is_dir()
 
 
+# One path component, in BYTES. ext4, APFS and NTFS all stop at 255, and
+# `Tap.safe_name` maps "/" to "__" — so the whole tap name becomes exactly one
+# component under `~/.boost/repos` and this is its ceiling. A GitHub owner/repo
+# maxes out at 140 (39 + 1 + 100), so nothing real comes near it.
+MAX_NAME_BYTES = 255
+
+
+def _looks_like_a_directory(p: Path) -> bool:
+    """True if `p` is an existing directory, False if the OS will not say.
+
+    `Path.exists()` is not total. pathlib swallows ENOENT, ENOTDIR, EBADF and
+    ELOOP — ENAMETOOLONG is *not* in that set, so a long enough component makes
+    `os.stat` raise straight out of `parse_spec` as a bare OSError, which is not
+    a BoostError and so is never framed by the CLI's error handling. A path the
+    OS refuses to look at is not a directory we can tap; that is a "no", not a
+    crash.
+    """
+    try:
+        return p.is_dir()
+    except OSError:
+        return False
+
+
 def parse_spec(spec: str):
     """Resolve a tap spec -> (name, url).
 
@@ -61,18 +84,35 @@ def parse_spec(spec: str):
     # own home-dir lookup (USERPROFILE on Windows), which ignores the $HOME
     # override the whole test suite (and BOOST_HOME sandboxing) relies on.
     p = paths.expand(spec)
-    if p.exists() and p.is_dir():
-        return (p.resolve().name, str(p.resolve()))
+    if _looks_like_a_directory(p):
+        return _checked(p.resolve().name, str(p.resolve()), spec)
     if spec.startswith(("http://", "https://", "git@", "ssh://")):
         tail = spec.split(":")[-1] if spec.startswith("git@") else spec
         parts = [x for x in tail.replace(".git", "").split("/") if x][-2:]
-        return ("/".join(parts), spec)
+        return _checked("/".join(parts), spec, spec)
     if "/" in spec and " " not in spec:
-        return (spec, "https://github.com/%s" % spec)
+        return _checked(spec, "https://github.com/%s" % spec, spec)
     raise BoostError("cannot parse tap spec %r" % spec,
                     hint="use owner/repo, a git URL, or a local directory")
 
 
+def _checked(name: str, url: str, spec: str) -> tuple[str, str]:
+    """The derived pair, or a BoostError if the name cannot be a directory.
+
+    The rule is on the *name*, never on the spec: a deep local path with a short
+    basename is a perfectly good tap, and its own length says nothing about the
+    component we are about to create. Caught here rather than at clone time,
+    where it surfaces as git's own ENAMETOOLONG on a path the user never typed.
+    """
+    if len(name.encode("utf-8")) > MAX_NAME_BYTES:
+        raise BoostError(
+            "tap name is too long (%d bytes, limit %d): %r"
+            % (len(name.encode("utf-8")), MAX_NAME_BYTES, spec[:80]),
+            hint="the name becomes one directory under ~/.boost/repos, and "
+                 "no filesystem accepts a longer component")
+    return (name, url)
+
+
 def list_taps() -> list[Tap]:
     """Configured taps from config.json.
 

{boost_skill_cli-1.2.4 → boost_skill_cli-1.2.6}/boost_cli/data/registries.json

@@ -1,8 +1,8 @@
 {
   "generated_note": "Curated skill/rule/workflow registries for boost. est_items are research estimates; verify by tapping. list_only repos are index/awesome lists that link out.",
-  "count": 472,
-  "est_items_total": 32697,
-  "est_items_scannable": 28276,
+  "count": 470,
+  "est_items_total": 32628,
+  "est_items_scannable": 28207,
   "registries": [
     {
       "name": "Aaronontheweb/dotnet-cursor-rules",
@@ -2534,17 +2534,6 @@
       "list_only": false,
       "curated": true
     },
-    {
-      "name": "MikroJit-Technologies/claude-skills",
-      "url": "https://github.com/MikroJit-Technologies/claude-skills",
-      "type": "skill",
-      "category": "infra",
-      "focus": "13 skills for infra engineers - MikroTik RouterOS Proxmox K3s... (21 skills)",
-      "est_items": 21,
-      "confidence": "med",
-      "list_only": false,
-      "curated": true
-    },
     {
       "name": "minhnv0807/ai-business-skills",
       "url": "https://github.com/minhnv0807/ai-business-skills",
@@ -4954,17 +4943,6 @@
       "list_only": false,
       "curated": true
     },
-    {
-      "name": "pcliangx/AppGenesisForge",
-      "url": "https://github.com/pcliangx/AppGenesisForge",
-      "type": "workflow",
-      "category": "meta",
-      "focus": "AI Agent Team scaffold for Claude Code - 19 roles collaborate through... (19 skills, 29 workflows)",
-      "est_items": 48,
-      "confidence": "high",
-      "list_only": false,
-      "curated": true
-    },
     {
       "name": "piomin/claude-ai-spring-boot",
       "url": "https://github.com/piomin/claude-ai-spring-boot",

{boost_skill_cli-1.2.4 → boost_skill_cli-1.2.6}/boost_skill_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.2.4
+Version: 1.2.6
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.2.4 → boost_skill_cli-1.2.6}/boost_skill_cli.egg-info/SOURCES.txt

@@ -335,6 +335,7 @@ docs/roadmap/items/one-shared-atomic-write-helper.md
 docs/roadmap/items/package-metadata-validation-twine-check-friends.md
 docs/roadmap/items/patch-coverage-gate-diff-cover.md
 docs/roadmap/items/path-traversal-unsanitized-rule-workflow-name.md
+docs/roadmap/items/pathlib-exists-is-not-total.md
 docs/roadmap/items/pep585-604-modernization-sweep.md
 docs/roadmap/items/performance-regression-gate-pytest-benchmark.md
 docs/roadmap/items/pin-the-lint-toolchain.md
@@ -410,6 +411,7 @@ docs/roadmap/items/sync-relinks-into-every-agent-ignoring-scope.md
 docs/roadmap/items/sync-reported-success-for-a-link-it-refused.md
 docs/roadmap/items/tap-signing-and-provenance-sigstore-minisign.md
 docs/roadmap/items/taps-check-out-freight-they-never-index.md
+docs/roadmap/items/the-catalogue-advertised-repos-that-no-longer-exist.md
 docs/roadmap/items/theme-asset-linting-stylelint-eslint.md
 docs/roadmap/items/tool-call-eval-tier.md
 docs/roadmap/items/two-crashes-that-should-have-been-messages.md
@@ -564,6 +566,9 @@ tests/fuzz/corpus/registry/05-empty.txt
 tests/fuzz/corpus/registry/06-space.txt
 tests/fuzz/corpus/registry/07-slash.txt
 tests/fuzz/corpus/registry/08-bare-host.txt
+tests/fuzz/corpus/registry/09-nul.txt
+tests/fuzz/corpus/registry/10-name-too-long.txt
+tests/fuzz/corpus/registry/11-long-owner-repo.txt
 tests/langchain/conftest.py
 tests/langchain/test_graph.py
 tests/langchain/test_loader.py

boost_skill_cli-1.2.6/docs/roadmap/items/pathlib-exists-is-not-total.md

@@ -0,0 +1,48 @@
+---
+id: pathlib-exists-is-not-total
+board: code
+section: internals
+status: shipped
+category: Bug
+complexity: S
+impact: Medium
+wow: 4
+note: the weekly fuzzer has now found two crashes in one function, three weeks apart, and been ignored both times
+order: 118
+owner: fix/tap-spec-name-too-long
+pr: 528
+title: <code>Path.exists()</code> looks total, and is not
+---
+<b><code>boost tap &lt;anything long enough&gt;</code> died with a raw traceback on Linux.</b>
+<code>parse_spec</code> probes whether the spec names an existing directory, and
+<code>pathlib</code> swallows only <b>ENOENT, ENOTDIR, EBADF and ELOOP</b> &mdash;
+<b>ENAMETOOLONG is not in that set</b>. So on any filesystem with a 255-byte component limit, which
+is to say ext4 and therefore every Linux runner and most users, <code>os.stat</code> raises straight
+out through <code>parse_spec</code> as a bare <code>OSError</code>. Not a <code>BoostError</code>,
+so the CLI's error handling never got to frame it.
+
+<b>macOS does not reproduce it.</b> That is the whole reason it shipped: the only thing that ever saw
+it was the scheduled Linux fuzz job.
+
+<b>Which had been reporting it for three weeks.</b> <code>fuzz.yml</code> runs libFuzzer over
+<code>parse_spec</code> weekly and has now failed <b>four scheduled runs out of four</b>. The first
+three were one bug &mdash; an embedded NUL &mdash; found on 2026-07-25, 08-01 and 08-08 and fixed
+after the third. The fourth, on 08-15, is this one, minimised to 91 bytes: <code>0x38</code>
+followed by ninety <code>0xff</code>, each un-decodable and so each becoming U+FFFD, which is
+<b>three</b> UTF-8 bytes apiece &mdash; <b>271 bytes</b> from an input only 91 characters long.
+
+<b>The limit is on bytes, and on the derived name.</b> Measuring characters would have let exactly
+this input through. Measuring the <em>spec</em> would have turned away a legitimate deep local path
+whose basename is short, so the rule applies to the name that is about to become one directory under
+<code>~/.boost/repos</code>, caught at the parse boundary rather than at clone time where it
+resurfaces as git's own ENAMETOOLONG on a path the user never typed.
+
+<b>Rejecting is only half of it.</b> A path the OS refuses to <em>look at</em> is a &ldquo;no&rdquo;,
+not a crash, so the probe is now total by construction &mdash; and pinned by a test on every
+platform, not only the one where it fails, because a test that needs a real over-long path proves
+nothing on the machine most of this is written on.
+
+<b>Both reproducers are now seeds.</b> The NUL one was fixed and never added to the corpus, so
+the fuzzer was free to spend runs rediscovering it. <code>tests/fuzz/corpus/registry/</code> carries
+both, which means the no-atheris seed smoke &mdash; the path that runs without the fuzzer installed
+&mdash; is now a regression test for both.

boost_skill_cli-1.2.6/docs/roadmap/items/the-catalogue-advertised-repos-that-no-longer-exist.md

@@ -0,0 +1,47 @@
+---
+id: the-catalogue-advertised-repos-that-no-longer-exist
+board: code
+section: internals
+status: shipped
+category: Bug
+complexity: S
+impact: Medium
+wow: 3
+note: a scheduled gate had never once passed, and the reason was one deleted upstream in its pinned corpus
+order: 117
+owner: fix/retire-dead-registries
+pr: 527
+title: a convention that said "verify the repo is real" verified nothing
+---
+<b>The <code>eval-scale</code> workflow has run once and failed once.</b> Not a retrieval
+regression &mdash; the gate refused to score, correctly, because it could not materialise its
+corpus: <code>pcliangx/AppGenesisForge</code> returns 404, so the clone falls through to
+<code>could not read Username for 'https://github.com'</code> and the whole 183-repo corpus is
+unavailable. The gate exits 75 rather than scoring the 182 that <em>are</em> reachable, and it is
+right to: measured, dropping the largest repo alone moves recall@10 from 0.852 to 0.885 and hit@1
+from 0.473 to 0.593, so a partial corpus clears the floors <em>more</em> easily than the real one.
+
+<b>The dead repo was not only in the corpus &mdash; it was in the shipped catalogue.</b> Auditing all
+<b>470</b> registries in <code>registries.json</code> against GitHub found <b>two</b> that no longer
+exist. The other one, <code>MikroJit-Technologies/claude-skills</code>, is already famous here: it is
+the tap that broke <code>boost update</code> for every other tap on the maintainer's machine. That
+bug was fixed by making the update loop survive a dead tap &mdash; and the catalogue went on
+recommending the repo to everyone else.
+
+<b>Deleting the rows is not the fix.</b> The catalogue is assembled from research batches, and a
+batch written before a repo vanished still names it, so the next sweep re-adds it from the same
+stale source. <code>RETIRED</code> is the record that survives the sweep: name plus the reason, with
+a test that fails if any of them reappears in a source tuple, in <code>LIST_ONLY</code>, or in the
+generated payload.
+
+<b>And the convention that should have caught this is now runnable.</b> CLAUDE.md has said
+&ldquo;verify a repo is real before adding it&rdquo; for a long time; six stale rows are what a
+convention with no command behind it is worth. <code>build_registries.py --verify-live</code> asks
+GitHub about every shipped registry and prints what it finds. It is deliberately <em>not</em> a gate:
+a required check over 470 third-party repos goes red the day any one of them is deleted, which is a
+fact about GitHub and not about the commit under test &mdash; the same reasoning that pins every row
+of <code>taps.txt</code> to a SHA.
+
+<b>Archived is not gone.</b> Four registries are archived upstream and stay: they still clone and
+still ship their items, and frozen is a different thing from deleted. The audit reports them
+separately for the same reason.

{boost_skill_cli-1.2.4 → boost_skill_cli-1.2.6}/docs/roadmap.html

@@ -133,7 +133,7 @@
       <div class="stat"><b>16</b><span>Shipped</span></div>
       <div class="stat"><b>1</b><span>Next up</span></div>
       <div class="stat"><b>7</b><span>Planned</span></div>
-      <div class="stat"><b>254</b><span>Loop finds</span></div>
+      <div class="stat"><b>256</b><span>Loop finds</span></div>
       <!-- /ROADMAP:stats -->
     </div>
   </section>
@@ -4076,6 +4076,95 @@ a hash.</p></details>
           <span class="m">42.9% of 750,416 embedded chunks are duplicates — one was embedded 1,464 times</span>
         </div>
       </article>
+
+      <article class="cap rcard" id="the-catalogue-advertised-repos-that-no-longer-exist">
+        <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Bug</span></div>
+        <h3>a convention that said "verify the repo is real" verified nothing</h3>
+        <details class="cardbody"><summary>Write-up</summary>
+        <p><b>The <code>eval-scale</code> workflow has run once and failed once.</b> Not a retrieval
+regression &mdash; the gate refused to score, correctly, because it could not materialise its
+corpus: <code>pcliangx/AppGenesisForge</code> returns 404, so the clone falls through to
+<code>could not read Username for 'https://github.com'</code> and the whole 183-repo corpus is
+unavailable. The gate exits 75 rather than scoring the 182 that <em>are</em> reachable, and it is
+right to: measured, dropping the largest repo alone moves recall@10 from 0.852 to 0.885 and hit@1
+from 0.473 to 0.593, so a partial corpus clears the floors <em>more</em> easily than the real one.
+
+<b>The dead repo was not only in the corpus &mdash; it was in the shipped catalogue.</b> Auditing all
+<b>470</b> registries in <code>registries.json</code> against GitHub found <b>two</b> that no longer
+exist. The other one, <code>MikroJit-Technologies/claude-skills</code>, is already famous here: it is
+the tap that broke <code>boost update</code> for every other tap on the maintainer's machine. That
+bug was fixed by making the update loop survive a dead tap &mdash; and the catalogue went on
+recommending the repo to everyone else.
+
+<b>Deleting the rows is not the fix.</b> The catalogue is assembled from research batches, and a
+batch written before a repo vanished still names it, so the next sweep re-adds it from the same
+stale source. <code>RETIRED</code> is the record that survives the sweep: name plus the reason, with
+a test that fails if any of them reappears in a source tuple, in <code>LIST_ONLY</code>, or in the
+generated payload.
+
+<b>And the convention that should have caught this is now runnable.</b> CLAUDE.md has said
+&ldquo;verify a repo is real before adding it&rdquo; for a long time; six stale rows are what a
+convention with no command behind it is worth. <code>build_registries.py --verify-live</code> asks
+GitHub about every shipped registry and prints what it finds. It is deliberately <em>not</em> a gate:
+a required check over 470 third-party repos goes red the day any one of them is deleted, which is a
+fact about GitHub and not about the commit under test &mdash; the same reasoning that pins every row
+of <code>taps.txt</code> to a SHA.
+
+<b>Archived is not gone.</b> Four registries are archived upstream and stay: they still clone and
+still ship their items, and frozen is a different thing from deleted. The audit reports them
+separately for the same reason.</p></details>
+        <div class="meta">
+          <span class="m">Complexity <b>S</b></span>
+          <span class="m">Impact <b>Medium</b></span>
+          <span class="m">Wow <b class="wow">★★★</b></span>
+          <span class="m">a scheduled gate had never once passed, and the reason was one deleted upstream in its pinned corpus</span>
+        </div>
+      </article>
+
+      <article class="cap rcard" id="pathlib-exists-is-not-total">
+        <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Bug</span></div>
+        <h3><code>Path.exists()</code> looks total, and is not</h3>
+        <details class="cardbody"><summary>Write-up</summary>
+        <p><b><code>boost tap &lt;anything long enough&gt;</code> died with a raw traceback on Linux.</b>
+<code>parse_spec</code> probes whether the spec names an existing directory, and
+<code>pathlib</code> swallows only <b>ENOENT, ENOTDIR, EBADF and ELOOP</b> &mdash;
+<b>ENAMETOOLONG is not in that set</b>. So on any filesystem with a 255-byte component limit, which
+is to say ext4 and therefore every Linux runner and most users, <code>os.stat</code> raises straight
+out through <code>parse_spec</code> as a bare <code>OSError</code>. Not a <code>BoostError</code>,
+so the CLI's error handling never got to frame it.
+
+<b>macOS does not reproduce it.</b> That is the whole reason it shipped: the only thing that ever saw
+it was the scheduled Linux fuzz job.
+
+<b>Which had been reporting it for three weeks.</b> <code>fuzz.yml</code> runs libFuzzer over
+<code>parse_spec</code> weekly and has now failed <b>four scheduled runs out of four</b>. The first
+three were one bug &mdash; an embedded NUL &mdash; found on 2026-07-25, 08-01 and 08-08 and fixed
+after the third. The fourth, on 08-15, is this one, minimised to 91 bytes: <code>0x38</code>
+followed by ninety <code>0xff</code>, each un-decodable and so each becoming U+FFFD, which is
+<b>three</b> UTF-8 bytes apiece &mdash; <b>271 bytes</b> from an input only 91 characters long.
+
+<b>The limit is on bytes, and on the derived name.</b> Measuring characters would have let exactly
+this input through. Measuring the <em>spec</em> would have turned away a legitimate deep local path
+whose basename is short, so the rule applies to the name that is about to become one directory under
+<code>~/.boost/repos</code>, caught at the parse boundary rather than at clone time where it
+resurfaces as git's own ENAMETOOLONG on a path the user never typed.
+
+<b>Rejecting is only half of it.</b> A path the OS refuses to <em>look at</em> is a &ldquo;no&rdquo;,
+not a crash, so the probe is now total by construction &mdash; and pinned by a test on every
+platform, not only the one where it fails, because a test that needs a real over-long path proves
+nothing on the machine most of this is written on.
+
+<b>Both reproducers are now seeds.</b> The NUL one was fixed and never added to the corpus, so
+the fuzzer was free to spend runs rediscovering it. <code>tests/fuzz/corpus/registry/</code> carries
+both, which means the no-atheris seed smoke &mdash; the path that runs without the fuzzer installed
+&mdash; is now a regression test for both.</p></details>
+        <div class="meta">
+          <span class="m">Complexity <b>S</b></span>
+          <span class="m">Impact <b>Medium</b></span>
+          <span class="m">Wow <b class="wow">★★★★</b></span>
+          <span class="m">the weekly fuzzer has now found two crashes in one function, three weeks apart, and been ignored both times</span>
+        </div>
+      </article>
       <!-- /ROADMAP:cards -->
 
     </div>

{boost_skill_cli-1.2.4 → boost_skill_cli-1.2.6}/scripts/build_registries.py

@@ -46,6 +46,26 @@ LIST_ONLY = {
     "langgptai/awesome-claude-prompts",
 }
 
+# Repos that were curated here and have since been deleted or made private.
+# They are recorded rather than merely deleted because the catalogue is
+# assembled from research batches: a batch written before the repo vanished
+# still names it, so dropping the row alone lets the next sweep re-add it from
+# the same stale source. Verified with `--verify-live`, which is the runnable
+# form of CLAUDE.md's "verify a repo is real before adding it" — a convention
+# that six dead rows proved does not enforce itself.
+#
+# Archived-but-reachable repos are deliberately NOT here. They still clone and
+# still ship their items; frozen is not gone.
+RETIRED = {
+    "MikroJit-Technologies/claude-skills":
+        "404 since 2026-08 — the tap that broke `boost update` for every "
+        "other tap on the maintainer's machine (see roadmap "
+        "one-dead-tap-broke-every-update)",
+    "pcliangx/AppGenesisForge":
+        "404 since 2026-08 — clone prompts for credentials, which is what "
+        "fails the scheduled eval-scale gate on its pinned corpus",
+}
+
 # --- skills (SKILL.md registries) -------------------------------------------
 SKILLS = [
     ("travisvn/awesome-claude-skills", "meta", "Curated awesome-list of Claude Skills, tools, and resources", 60, "high"),
@@ -291,7 +311,6 @@ SKILLS = [
     ("anmolnagpal/devops-skills", "infra", "Multi-tool DevOps skills for Claude Code, Cursor, and Codex... (18 skills, 17 rules)", 35, "med"),
     ("kcns008/cluster-skills", "infra", "A collection of skills for AI coding agents working with Kubernetes... (19 skills, 13 workflows)", 32, "med"),
     ("oci-ai-architects/cline-oci-ai-architect-skills", "infra", "Cline skills, rules, and workflows for AI Architects. Cross-platform... (14 skills, 2 rules, 11 workflows)", 27, "med"),
-    ("MikroJit-Technologies/claude-skills", "infra", "13 skills for infra engineers - MikroTik RouterOS Proxmox K3s... (21 skills)", 21, "med"),
     ("qwedsazxc78/devops-ai-skill", "infra", "Cross-platform DevOps AI Skill Pack - Horus (IaC) + Zeus (GitOps)... (14 skills, 7 workflows)", 21, "med"),
     ("foxj77/claude-code-skills", "infra", "Claude Code skills for Kubernetes platform engineering, GitOps, and... (19 skills)", 19, "med"),
     ("pulumi/agent-skills", "infra", "15 skills", 15, "high"),
@@ -581,7 +600,6 @@ WORKFLOWS = [
     ("composio-community/awesome-claude-plugins", "meta", "A curated list of Plugins that let you extend Claude Code with custom... (23 skills, 38 workflows)", 61, "high"),
     ("anthropics/claude-plugins-official", "meta", "Official, Anthropic-managed directory of high quality Claude Code Plugins (60 workflows)", 60, "high"),
     ("glittercowboy/taches-cc-resources", "meta", "A collection of my favorite custom Claude Code resources to make life... (12 skills, 42 workflows)", 54, "high"),
-    ("pcliangx/AppGenesisForge", "meta", "AI Agent Team scaffold for Claude Code - 19 roles collaborate through... (19 skills, 29 workflows)", 48, "high"),
     ("anthropics/claude-cookbooks", "meta", "A collection of notebooks/recipes showcasing some fun and effective... (4 skills, 11 workflows)", 15, "high"),
     # --- end 2026-07 batch ---
 ]
@@ -659,6 +677,57 @@ def _summary(payload: dict) -> None:
         print("  %-9s %3d repos  ~%d items" % (typ, n, est))
 
 
+def verify_live(names: list[str], token: str | None = None) -> int:
+    """Report which of ``names`` no longer resolve on GitHub.
+
+    Deliberately NOT part of `--check` or any required gate. The lesson
+    `tests/eval/taps.txt` already records — pin third-party repos, never let
+    someone else's push decide whether our build is green — applies here twice
+    over: a required check that queries 470 repos would go red the day any one
+    of them is deleted, which is a fact about GitHub rather than about this
+    commit. Run it when curating, and record what it finds in RETIRED.
+
+    Returns the number of repos that could not be resolved.
+    """
+    import http.client
+    import urllib.error
+    import urllib.request
+
+    missing, archived = [], []
+    for i, name in enumerate(names, 1):
+        req = urllib.request.Request(  # noqa: S310  the https prefix is a literal
+            "https://api.github.com/repos/%s" % name,
+            headers={"Accept": "application/vnd.github+json",
+                     "User-Agent": "boost-registry-audit"})
+        if token:
+            req.add_header("Authorization", "token %s" % token)
+        try:
+            with urllib.request.urlopen(req, timeout=30) as fh:  # noqa: S310  same
+                if json.loads(fh.read().decode("utf-8")).get("archived"):
+                    archived.append(name)
+        except urllib.error.HTTPError as exc:
+            if exc.code in (404, 451):
+                missing.append(name)
+            else:                       # rate limit, transient 5xx — not a verdict
+                print("  ? %-50s HTTP %s" % (name, exc.code), file=sys.stderr)
+        except (OSError, http.client.HTTPException,
+                json.JSONDecodeError) as exc:
+            # A truncated response is a fact about the network, not about the
+            # repo — 470 sequential requests will hit one, and a sweep that
+            # aborts on it reports "clean" for everything it never reached.
+            print("  ? %-50s %s" % (name, exc), file=sys.stderr)
+        if i % 50 == 0:
+            print("  ...%d/%d" % (i, len(names)), file=sys.stderr)
+
+    for name in archived:
+        print("archived  %s" % name)
+    for name in missing:
+        print("MISSING   %s" % name)
+    print("%d checked: %d missing, %d archived"
+          % (len(names), len(missing), len(archived)), file=sys.stderr)
+    return len(missing)
+
+
 def main(argv: list[str] | None = None) -> int:
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument(
@@ -666,11 +735,22 @@ def main(argv: list[str] | None = None) -> int:
         help="verify the committed JSON matches a fresh build; exit 1 on drift "
              "(does not write). Used in CI to catch un-regenerated edits.",
     )
+    parser.add_argument(
+        "--verify-live", action="store_true",
+        help="ask GitHub whether every shipped registry still exists and print "
+             "the ones that do not. Needs network; never part of a gate. Set "
+             "GITHUB_TOKEN to lift the 60/hour anonymous rate limit.",
+    )
     args = parser.parse_args(argv)
 
     payload = build_payload()
     fresh = render(payload)
 
+    if args.verify_live:
+        import os
+        names = [e["name"] for e in payload["registries"]]
+        return 1 if verify_live(names, os.environ.get("GITHUB_TOKEN")) else 0
+
     if args.check:
         current = DEST.read_text(encoding="utf-8") if DEST.exists() else ""
         if current != fresh:

{boost_skill_cli-1.2.4 → boost_skill_cli-1.2.6}/tests/eval/taps-scale.txt

@@ -12,9 +12,9 @@
 # fail. It is A scale, not THE scale: hit@1 decays continuously with corpus
 # size and never plateaus, so no size here can be canonical.
 #
-# 163 distractor registries, 20,017 est items (the curated list's own estimate).
+# 165 distractor registries, 20,034 est items (the curated list's own estimate).
 # est_items under-reports by about 2.5x against a real install, so that
-# projects to roughly 50,817 actual entries — a projection, not a measurement.
+# projects to roughly 50,860 actual entries — a projection, not a measurement.
 # The real counts are written in by `eval_corpus.py --refresh`, which is
 # also what pins these rows. Regenerating KEEPS any pin already here, so
 # --check verifies the selection, not the pins.
@@ -130,83 +130,85 @@ glittercowboy/taches-cc-resources
 40RTY-ai/shopify-admin-skills
 aiwonglab/claude_code_agents
 guanyang/open-agent-hub
-pcliangx/AppGenesisForge
-phuryn/pm-skills
 trailofbits/skills
-glebis/claude-skills
+phuryn/pm-skills
 cloudflare/agents
-browser-act/skills
+glebis/claude-skills
 pluginagentmarketplace/custom-plugin-nextjs
-forcedotcom/sf-skills
+browser-act/skills
 syahiidkamil/Software-Engineer-AI-Agent-Atlas
-Orchestra-Research/AI-Research-SKILLs
+forcedotcom/sf-skills
 alirezarezvani/claude-code-skill-factory
-majiayu000/spellbook
+Orchestra-Research/AI-Research-SKILLs
 datopian/portaljs
-openakita/openakita
+majiayu000/spellbook
 dl-ezo/claude-code-sub-agents
-Leooooooow/Awesome-eCommerce-Skills
+openakita/openakita
 humanlayer/humanlayer
-elementalsouls/Claude-BugHunter
+Leooooooow/Awesome-eCommerce-Skills
 anthropics/claude-code
-full-stack-skills/t2ui-skills
+elementalsouls/Claude-BugHunter
 lst97/claude-code-sub-agents
-google/skills
+full-stack-skills/t2ui-skills
 darrenhinde/OpenAgentsControl
-lebsral/DSPy-Programming-not-prompting-LMs-skills
+google/skills
 dotnet/skills
-SpaceZephyr/myskill
+lebsral/DSPy-Programming-not-prompting-LMs-skills
 danielrosehill/Claude-Slash-Commands
-ihlamury/design-skills
+SpaceZephyr/myskill
 kasperjunge/agent-resources-legacy
-dpearson2699/swift-ios-skills
+ihlamury/design-skills
 centminmod/my-claude-code-setup
-inference-sh/skills
+dpearson2699/swift-ios-skills
 pluginagentmarketplace/custom-plugin-kotlin
-product-on-purpose/pm-skills
+inference-sh/skills
 hnaymyh123-henry/claude-dev-skill
-tech-leads-club/agent-skills
+product-on-purpose/pm-skills
 klovaaxel/web-a11y-agent-skills
-zhaoxuya520/reverse-skill
+tech-leads-club/agent-skills
 brennercruvinel/CCPlugins
-ninehills/skills
+zhaoxuya520/reverse-skill
 vijaythecoder/awesome-claude-agents
-syncfusion/maui-ui-components-skills
+ninehills/skills
 codenamev/ai-software-architect
-ancoleman/ai-design-components
+syncfusion/maui-ui-components-skills
 steipete/agent-rules
-deanpeters/Product-Manager-Skills
+ancoleman/ai-design-components
 talknerdytome-labs/claude-agents
-jamditis/claude-skills-journalism
+deanpeters/Product-Manager-Skills
 anthropics/claude-cookbooks
-Houseofmvps/ultraship
+jamditis/claude-skills-journalism
 glapsfun/cnative-skills
-jame581/GodotPrompter
+Houseofmvps/ultraship
 iannuttall/claude-agents
-BuilderIO/agent-native
+jame581/GodotPrompter
 ducpm2303/claude-java-plugins
-SamurAIGPT/Generative-Media-Skills
+BuilderIO/agent-native
 piomin/claude-ai-spring-boot
-tradermonty/claude-trading-skills
+SamurAIGPT/Generative-Media-Skills
 anthropics/claude-code-action
-LambdaTest/agent-skills
+tradermonty/claude-trading-skills
 anthropics/financial-services
-anbeime/skill
+LambdaTest/agent-skills
 hikarubw/claude-commands
-internet-court/internet-court-skill
+anbeime/skill
 anthropics/claude-agent-sdk-demos
-TheGoat395/Codex-Skills
+internet-court/internet-court-skill
 comet-ml/opik-claude-code-plugin
-daymade/claude-code-skills
+TheGoat395/Codex-Skills
 docker/claude-plugins
-JasonColapietro/suede-creator-skills
+daymade/claude-code-skills
 langchain-ai/deepagents
-bergside/awesome-design-skills
+JasonColapietro/suede-creator-skills
 zenml-io/skills
-air-gapped/skills
+bergside/awesome-design-skills
 DavidROliverBA/Daves-Claude-Code-Skills
-jeffallan/claude-skills
+air-gapped/skills
 anthropics/claude-agent-sdk-typescript
-spencerpauly/awesome-cursor-skills
+jeffallan/claude-skills
 anthropics/claude-code-security-review
+spencerpauly/awesome-cursor-skills
+anthropics/cwc-long-running-agents
 chaterm/terminal-skills
+jeremylongshore/claude-code-plugins-plus-skills
+wondelai/skills

boost_skill_cli-1.2.6/tests/fuzz/corpus/registry/10-name-too-long.txt

@@ -0,0 +1 @@
+8������������������������������������������������������������������������������������������