boost-skill-cli 1.2.57__tar.gz → 1.2.59__tar.gz

{boost_skill_cli-1.2.57/boost_skill_cli.egg-info → boost_skill_cli-1.2.59}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.2.57
+Version: 1.2.59
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License-Expression: Apache-2.0

{boost_skill_cli-1.2.57 → boost_skill_cli-1.2.59}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.2.57'
-__version_tuple__ = version_tuple = (1, 2, 57)
+__version__ = version = '1.2.59'
+__version_tuple__ = version_tuple = (1, 2, 59)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.2.57 → boost_skill_cli-1.2.59}/boost_cli/commands/quality.py

@@ -24,6 +24,7 @@ from ..core import (
     agents,
     ai,
     catalog,
+    claude_settings,
     complete,
     frontmatter,
     gitutil,
@@ -549,6 +550,20 @@ def cmd_doctor(argv):
                  "left alone; yours to remove or repair"
                  % (len(foreign), _s(len(foreign))))
 
+    others = claude_settings.foreign_hooks("global")
+    if others:
+        # `out.info`, not `bad`, for the same reason as the foreign symlinks
+        # above: boost did not write these and will never remove them, so
+        # counting them would leave doctor permanently red on something no
+        # boost command can clear. Naming them is still worth a line — at
+        # 130k stars gstack is now a likely second writer of this exact file,
+        # and a user debugging a hook needs to know boost is not the only one
+        # in it.
+        events = sorted({h["event"] for h in others})
+        out.info("%d hook%s in ~/.claude/settings.json not managed by boost "
+                 "(%s) — left alone; `boost hooks` only touches its own"
+                 % (len(others), _s(len(others)), ", ".join(events)), wrap=True)
+
     for dup in store.duplicate_discovery():
         # An agent that reads the canonical store natively, holding its own
         # entry for a skill that store already carries. Boost did not put it

{boost_skill_cli-1.2.57 → boost_skill_cli-1.2.59}/boost_cli/core/claude_settings.py

@@ -200,6 +200,42 @@ def has_hook(scope: str, event: str, name: str,
     return False
 
 
+def foreign_hooks(scope: str | None = None,
+                  project_dir: Path | None = None,
+                  host: str = hookhost.CLAUDE) -> list[dict]:
+    """Hooks in this host's settings that boost does not own.
+
+    The complement of :func:`list_hooks`, which skips every entry without the
+    `# boost:` marker — so boost could write this file for years and never be
+    able to say who else was writing it. That matters now that a settings.json
+    routinely has more than one writer: `garrytan/gstack`'s `./setup` registers
+    its own Stop hooks here and prunes "dead gstack entries" on every run, and
+    boost prunes its own by marker. The two namespaces are disjoint and
+    `tests/unit/test_gstack_coexistence.py` pins that they stay that way.
+
+    This exists so `boost doctor` can *report* the other tenant rather than
+    discover it by deleting something. Nothing here writes: a foreign hook is
+    not a boost problem to fix, it is context for a user reading a health
+    check — which is why doctor counts it with `out.info` rather than raising
+    the issue count.
+    """
+    scopes = (scope,) if scope else SCOPES
+    rows: list[dict] = []
+    for sc in scopes:
+        data = load(sc, project_dir, host)
+        for event, blocks in (data.get("hooks") or {}).items():
+            for block in blocks or []:
+                if not isinstance(block, dict):
+                    continue
+                for h in block.get("hooks") or []:
+                    raw = str(h.get("command", ""))
+                    if _hook_name(raw) is not None:
+                        continue        # ours
+                    rows.append({"scope": sc, "event": event, "command": raw,
+                                 "matcher": block.get("matcher", "")})
+    return rows
+
+
 def list_hooks(scope: str | None = None,
                project_dir: Path | None = None,
                host: str = hookhost.CLAUDE) -> list[dict]:

{boost_skill_cli-1.2.57 → boost_skill_cli-1.2.59}/boost_cli/core/config.py

@@ -131,6 +131,31 @@ def load_registry_catalog() -> list:
     return data.get("registries", [])
 
 
+def self_installing_command(tap: str) -> str | None:
+    """The repo's own install command, when boost must not copy its items.
+
+    Some registries are real catalogues of Markdown and some are programs that
+    happen to ship Markdown entry points. For the second kind boost's install —
+    copy the item's directory into the canonical store, symlink it out — yields
+    a skill that *looks* installed and cannot run, because the step that makes
+    it work is the repo's own build, not a fetch. Returns the upstream command
+    so the caller can name it instead of pretending; None for every other tap.
+
+    The tap may be addressed by full ``owner/repo`` or by the bare repo name a
+    clone directory carries, so both resolve.
+    """
+    if not tap:
+        return None
+    for row in load_registry_catalog():
+        cmd = row.get("self_installing")
+        if not cmd:
+            continue
+        name = row.get("name") or ""
+        if tap in (name, name.split("/")[-1]):
+            return cmd
+    return None
+
+
 def _merge(base: dict, override: dict) -> dict:
     out = deepcopy(base)
     # `or {}`: the only caller feeds this json.loads() of config.json, so a file

{boost_skill_cli-1.2.57 → boost_skill_cli-1.2.59}/boost_cli/core/store.py

@@ -17,6 +17,7 @@ from pathlib import Path
 from ..errors import BoostError
 from . import (
     agents,
+    config,
     gitutil,
     journal,
     lockfile,
@@ -489,6 +490,24 @@ def _require_project_base(scope: str, base, what: str) -> Path | None:
     return resolved
 
 
+def _refuse_self_installing(entry: dict) -> None:
+    """Refuse to half-copy an item whose repo installs itself.
+
+    Checked before the kind dispatch because the property belongs to the repo,
+    not the item: every kind it ships has the same missing build step. Naming
+    the upstream command is the whole point — a refusal that only says "no"
+    leaves the user exactly where `boost install` pretending would have.
+    """
+    cmd = config.self_installing_command(entry.get("tap") or "")
+    if not cmd:
+        return
+    raise BoostError(
+        "%s comes from %s, which installs itself — boost would copy its "
+        "Markdown and leave a skill that cannot run"
+        % (entry.get("name", "?"), entry.get("tap", "?")),
+        hint="run the registry's own installer: %s" % cmd)
+
+
 def install(entry: dict, force: bool = False,
             only_agents: list[str] | None = None,
             scope: str = "user", base=None) -> InstallResult:
@@ -499,6 +518,7 @@ def install(entry: dict, force: bool = False,
     current repo). Every kind honors it.
     """
     scopes.check_scope(scope)
+    _refuse_self_installing(entry)
     kind = entry.get("kind", "skill")
     if kind == "rule":
         return _install_rule(entry, force=force, only_agents=only_agents,

{boost_skill_cli-1.2.57 → boost_skill_cli-1.2.59}/boost_cli/data/registries.json

@@ -1,8 +1,8 @@
 {
   "generated_note": "Curated skill/rule/workflow registries for boost. est_items are research estimates; verify by tapping. list_only repos are index/awesome lists that link out.",
-  "count": 486,
-  "est_items_total": 34840,
-  "est_items_scannable": 30419,
+  "count": 487,
+  "est_items_total": 34901,
+  "est_items_scannable": 30480,
   "registries": [
     {
       "name": "Aaronontheweb/dotnet-cursor-rules",
@@ -1621,6 +1621,18 @@
       "list_only": false,
       "curated": true
     },
+    {
+      "name": "garrytan/gstack",
+      "url": "https://github.com/garrytan/gstack",
+      "type": "skill",
+      "category": "workflow",
+      "focus": "Sprint-workflow slash commands \u2014 /ship, /qa, /review, /plan-*, /retro, /office-hours \u2014 self-installing across ten coding agents",
+      "est_items": 61,
+      "confidence": "high",
+      "list_only": false,
+      "curated": true,
+      "self_installing": "git clone --single-branch --depth 1 https://github.com/garrytan/gstack.git ~/.claude/skills/gstack && cd ~/.claude/skills/gstack && ./setup"
+    },
     {
       "name": "GDvega/super-android-kotlin-firebase-skill",
       "url": "https://github.com/GDvega/super-android-kotlin-firebase-skill",

{boost_skill_cli-1.2.57 → boost_skill_cli-1.2.59/boost_skill_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.2.57
+Version: 1.2.59
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License-Expression: Apache-2.0

{boost_skill_cli-1.2.57 → boost_skill_cli-1.2.59}/boost_skill_cli.egg-info/SOURCES.txt

@@ -658,6 +658,7 @@ tests/unit/test_aihost.py
 tests/unit/test_bmad_core.py
 tests/unit/test_boost_first_offer.py
 tests/unit/test_bootstrap.py
+tests/unit/test_bot_pr_dco.py
 tests/unit/test_branch_current.py
 tests/unit/test_browse.py
 tests/unit/test_builtin.py
@@ -723,6 +724,7 @@ tests/unit/test_gitleaks_config.py
 tests/unit/test_gitutil.py
 tests/unit/test_gitutil_lfs.py
 tests/unit/test_gitutil_sparse.py
+tests/unit/test_gstack_coexistence.py
 tests/unit/test_hook_settings_hosts.py
 tests/unit/test_hookhost.py
 tests/unit/test_imperative.py

{boost_skill_cli-1.2.57 → boost_skill_cli-1.2.59}/docs/roadmap/items/gstack-tap-first-then-coexistence.md

@@ -2,22 +2,24 @@
 id: gstack-tap-first-then-coexistence
 board: code
 section: compat
-status: planned
+status: shipped
 category: Interop · Registry
 complexity: M
 impact: Med
 wow: 3
 note: 130k stars of SKILL.md that boost can index today, and a second installer writing into the same dotdirs
 order: 106
-owner:
+owner: feat/gstack-registry
 pr:
 title: <code>garrytan/gstack</code> &mdash; tap it first, then learn to coexist with it
 ---
 <a href="https://github.com/garrytan/gstack">garrytan/gstack</a> is the largest thing in
 boost's domain that boost has never heard of: <b>130,344 stars, 19,602 forks</b>, MIT, created
-2026-03-11 and pushed the same day this was written. It ships roughly 35 slash-command skills
+2026-03-11 and pushed the same day this was written. It ships <b>61 measured items</b> &mdash; the repo
+<em>description</em> advertises 23 and its README lists ~35, and
+<code>scripts/measure_registry.py</code> over a sparse clone of <code>07b59e39</code> counts 61
 &mdash; <code>/review</code>, <code>/ship</code>, <code>/qa</code>, <code>/cso</code>,
-<code>/autoplan</code>, <code>/office-hours</code> &mdash; each as a
+<code>/autoplan</code>, <code>/office-hours</code> among them, each as a
 <code>&lt;name&gt;/SKILL.md</code> directory at the repo root, which is <em>exactly</em> the
 layout <code>catalog.scan_dir</code> already indexes. Nothing needs building for boost to
 catalogue it.
@@ -53,12 +55,16 @@ Boost should not own bun, Chromium, or someone else's upgrade channel.
 into the same places boost does, and at 130k stars it is now the likeliest other tenant on a
 user's machine:
 
-<b>The canonical store.</b> Repo-local gstack installs land at
-<code>.agents/skills/gstack</code> &mdash; the same path boost treats as its single source of
-truth. <code>store.duplicate_discovery()</code> is already <em>topology, not ownership</em>, for
-exactly this reason, and <code>heal --prune-duplicates</code> must keep proving it: gstack's
-directories are real directories and its per-host copies are its own, so neither may ever be
-swept as "boost's stale links".
+<b>The canonical store.</b> <b>Corrected on implementation:</b> this card claimed repo-local
+gstack installs land at <code>.agents/skills/gstack</code>. They do not &mdash; gstack's README
+installs to <code>~/.claude/skills/gstack</code>, a <em>real directory</em> inside a linking
+agent's skills dir, and the team install bootstraps <code>.claude/</code> rather than
+<code>.agents/</code>. The hazard is real either way and lands one path over:
+<code>store.duplicate_discovery()</code> is already <em>topology, not ownership</em>, and
+<code>sync_plan</code>'s stale-link sweep asks <code>is_symlink()</code> before anything else, so
+gstack's real directories are never candidates. Neither had a test saying so, and the cost of
+being wrong is an 8&nbsp;MB working install of someone else's program deleted as "boost's stale
+links".
 
 <b>Host dotdirs boost does not target.</b> gstack installs to
 <code>~/.codex/skills/gstack-*</code>, <code>~/.config/opencode/skills/gstack-*</code>,

{boost_skill_cli-1.2.57 → boost_skill_cli-1.2.59}/docs/roadmap/items/ragas-unpin-when-upstream-ships.md

@@ -7,7 +7,7 @@ category: Tech-debt
 complexity: S
 impact: Low
 wow: 1
-note: blocked on ragas shipping a release after 0.4.3 — check before starting
+note: still blocked — re-checked 2026-08-30, PyPI's newest ragas is still 0.4.3
 order: 97
 title: unpin the <code>[eval]</code> langchain stack when ragas ships its fix
 ---
@@ -27,6 +27,11 @@ pins, and adapt <code>scripts/eval_explain.py</code> if the 0.4 scoring API move
 <code>test_eval_faithfulness.py</code> stubs in the unit suite). The <code>eval-explain</code> workflow is
 the live proof — it must stay green with real keys.
 
+<b>Re-checked 2026-08-30.</b> <code>pip index versions ragas</code> still reports
+<code>0.4.3</code> as the newest release, so nothing has changed and this card is still not
+claimable. Recorded here rather than left implicit: a card that says "check before starting"
+gives a reader no way to tell a check that came back negative from a check nobody ran.
+
 <b>Why it stays its own card.</b> The shipped integration card documents the block but will not be
 re-read; an unpin nobody remembers is how a workaround pin outlives its reason by years. This card
 is the reminder, and it is deliberately not claimable until the upstream release exists.

{boost_skill_cli-1.2.57 → boost_skill_cli-1.2.59}/docs/roadmap/items/tool-call-eval-tier.md

@@ -2,13 +2,13 @@
 id: tool-call-eval-tier
 board: code
 section: planned
-status: inflight
+status: planned
 category: Quality · Eval
 complexity: L
 impact: High
 wow: 4
-note: boost floors four retrieval metrics and measures whether an agent ever calls the tools zero times
-owner: feat/tool-call-eval
+note: Claude Code arm shipped in #616; the second host arm is unwritten and the card stays open for it
+owner:
 order: 96
 title: a Tier 3 eval for tool-call behaviour, floored in <b>both</b> directions
 ---
@@ -61,6 +61,23 @@ N runs per prompt with an interval rather than a single pass/fail, the way
 <code>golden-set-statistical-power</code> established for retrieval — a one-shot replay cannot tell
 a wording regression from a sampling wobble.
 
+<b>Where this stands (2026-08-30).</b> The Claude Code arm shipped in #616:
+<code>scripts/eval_tools.py</code>, a 16-prompt set halved into should-call and should-NOT-call,
+Wilson intervals over N runs, and a verdict that floors call rate <em>and</em> ceilings false
+calls. Its first real run measured <b>3/3 false calls</b> &mdash; boost's tools fired on "What is
+the difference between a Python list and a tuple?", which the shipped skip list excuses by name.
+Call rate alone would have scored that a perfect 1.00, which is the whole argument for flooring
+both directions, now with a number behind it.
+
+<b>The card stays open because "per host, never averaged" is the binding requirement and only one
+host has been driven.</b> Gemini CLI is not installed on the machine this was built on, and its
+successor Antigravity CLI (<code>agy</code>, which boost already supports as its fifth agent
+target and which has boost registered) cannot be driven from a sandbox: it starts a local
+language server and dies on <code>listen tcp 127.0.0.1:0: bind: operation not permitted</code>.
+Shipping an arm for a host nobody drove would put a number next to a measurement that never
+happened &mdash; the exact unfalsifiable claim this tier exists to retire. The <code>owner</code>
+is cleared rather than left on a merged branch, so the second arm is claimable.
+
 <b>What it unlocks.</b> The first honest answer to "did that description edit help", a baseline the
 next surface change can regress against, and a way to retire claims that survive only because
 nobody can check them.

{boost_skill_cli-1.2.57 → boost_skill_cli-1.2.59}/docs/roadmap.html

@@ -814,7 +814,7 @@ an oversight.</p></details>
       </article>
 
       <article class="cap rcard" id="tool-call-eval-tier">
-        <div class="head"><span class="pill inflight">In flight</span><span class="cat">Quality · Eval</span></div>
+        <div class="head"><span class="pill planned">Planned</span><span class="cat">Quality · Eval</span></div>
         <h3>a Tier 3 eval for tool-call behaviour, floored in <b>both</b> directions</h3>
         <p>boost's required gate floors <b>four</b> retrieval metrics — recall@k &ge; 0.78, hit@1 &ge; 0.40,
 MRR &ge; 0.52, nDCG@k &ge; 0.58 — over a 91-query golden set and a 10,152-entry corpus, every
@@ -865,6 +865,23 @@ N runs per prompt with an interval rather than a single pass/fail, the way
 <code>golden-set-statistical-power</code> established for retrieval — a one-shot replay cannot tell
 a wording regression from a sampling wobble.
 
+<b>Where this stands (2026-08-30).</b> The Claude Code arm shipped in #616:
+<code>scripts/eval_tools.py</code>, a 16-prompt set halved into should-call and should-NOT-call,
+Wilson intervals over N runs, and a verdict that floors call rate <em>and</em> ceilings false
+calls. Its first real run measured <b>3/3 false calls</b> &mdash; boost's tools fired on "What is
+the difference between a Python list and a tuple?", which the shipped skip list excuses by name.
+Call rate alone would have scored that a perfect 1.00, which is the whole argument for flooring
+both directions, now with a number behind it.
+
+<b>The card stays open because "per host, never averaged" is the binding requirement and only one
+host has been driven.</b> Gemini CLI is not installed on the machine this was built on, and its
+successor Antigravity CLI (<code>agy</code>, which boost already supports as its fifth agent
+target and which has boost registered) cannot be driven from a sandbox: it starts a local
+language server and dies on <code>listen tcp 127.0.0.1:0: bind: operation not permitted</code>.
+Shipping an arm for a host nobody drove would put a number next to a measurement that never
+happened &mdash; the exact unfalsifiable claim this tier exists to retire. The <code>owner</code>
+is cleared rather than left on a merged branch, so the second arm is claimable.
+
 <b>What it unlocks.</b> The first honest answer to "did that description edit help", a baseline the
 next surface change can regress against, and a way to retire claims that survive only because
 nobody can check them.</p>
@@ -872,7 +889,7 @@ nobody can check them.</p>
           <span class="m">Complexity <b>L</b></span>
           <span class="m hi">Impact <b>High</b></span>
           <span class="m">Wow <b class="wow">★★★★</b></span>
-          <span class="m">boost floors four retrieval metrics and measures whether an agent ever calls the tools zero times</span>
+          <span class="m">Claude Code arm shipped in</span>
         </div>
       </article>
 
@@ -895,6 +912,11 @@ pins, and adapt <code>scripts/eval_explain.py</code> if the 0.4 scoring API move
 <code>test_eval_faithfulness.py</code> stubs in the unit suite). The <code>eval-explain</code> workflow is
 the live proof — it must stay green with real keys.
 
+<b>Re-checked 2026-08-30.</b> <code>pip index versions ragas</code> still reports
+<code>0.4.3</code> as the newest release, so nothing has changed and this card is still not
+claimable. Recorded here rather than left implicit: a card that says "check before starting"
+gives a reader no way to tell a check that came back negative from a check nobody ran.
+
 <b>Why it stays its own card.</b> The shipped integration card documents the block but will not be
 re-read; an unpin nobody remembers is how a workaround pin outlives its reason by years. This card
 is the reminder, and it is deliberately not claimable until the upstream release exists.</p>
@@ -902,7 +924,7 @@ is the reminder, and it is deliberately not claimable until the upstream release
           <span class="m">Complexity <b>S</b></span>
           <span class="m">Impact <b>Low</b></span>
           <span class="m">Wow <b class="wow">★</b></span>
-          <span class="m">blocked on ragas shipping a release after 0.4.3 — check before starting</span>
+          <span class="m">still blocked — re-checked 2026-08-30, PyPI's newest ragas is still 0.4.3</span>
         </div>
       </article>
 
@@ -11844,13 +11866,16 @@ about 4.7&times; by sampling and then re-ranked by a filter the report never men
       </article>
 
       <article class="cap rcard" id="gstack-tap-first-then-coexistence">
-        <div class="head"><span class="pill planned">Planned</span><span class="cat">Interop · Registry</span></div>
+        <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Interop · Registry</span></div>
         <h3><code>garrytan/gstack</code> &mdash; tap it first, then learn to coexist with it</h3>
+        <details class="cardbody"><summary>Write-up</summary>
         <p><a href="https://github.com/garrytan/gstack">garrytan/gstack</a> is the largest thing in
 boost's domain that boost has never heard of: <b>130,344 stars, 19,602 forks</b>, MIT, created
-2026-03-11 and pushed the same day this was written. It ships roughly 35 slash-command skills
+2026-03-11 and pushed the same day this was written. It ships <b>61 measured items</b> &mdash; the repo
+<em>description</em> advertises 23 and its README lists ~35, and
+<code>scripts/measure_registry.py</code> over a sparse clone of <code>07b59e39</code> counts 61
 &mdash; <code>/review</code>, <code>/ship</code>, <code>/qa</code>, <code>/cso</code>,
-<code>/autoplan</code>, <code>/office-hours</code> &mdash; each as a
+<code>/autoplan</code>, <code>/office-hours</code> among them, each as a
 <code>&lt;name&gt;/SKILL.md</code> directory at the repo root, which is <em>exactly</em> the
 layout <code>catalog.scan_dir</code> already indexes. Nothing needs building for boost to
 catalogue it.
@@ -11886,12 +11911,16 @@ Boost should not own bun, Chromium, or someone else's upgrade channel.
 into the same places boost does, and at 130k stars it is now the likeliest other tenant on a
 user's machine:
 
-<b>The canonical store.</b> Repo-local gstack installs land at
-<code>.agents/skills/gstack</code> &mdash; the same path boost treats as its single source of
-truth. <code>store.duplicate_discovery()</code> is already <em>topology, not ownership</em>, for
-exactly this reason, and <code>heal --prune-duplicates</code> must keep proving it: gstack's
-directories are real directories and its per-host copies are its own, so neither may ever be
-swept as "boost's stale links".
+<b>The canonical store.</b> <b>Corrected on implementation:</b> this card claimed repo-local
+gstack installs land at <code>.agents/skills/gstack</code>. They do not &mdash; gstack's README
+installs to <code>~/.claude/skills/gstack</code>, a <em>real directory</em> inside a linking
+agent's skills dir, and the team install bootstraps <code>.claude/</code> rather than
+<code>.agents/</code>. The hazard is real either way and lands one path over:
+<code>store.duplicate_discovery()</code> is already <em>topology, not ownership</em>, and
+<code>sync_plan</code>'s stale-link sweep asks <code>is_symlink()</code> before anything else, so
+gstack's real directories are never candidates. Neither had a test saying so, and the cost of
+being wrong is an 8&nbsp;MB working install of someone else's program deleted as "boost's stale
+links".
 
 <b>Host dotdirs boost does not target.</b> gstack installs to
 <code>~/.codex/skills/gstack-*</code>, <code>~/.config/opencode/skills/gstack-*</code>,
@@ -11912,7 +11941,7 @@ should be able to <em>see</em> a foreign hook block and report it without touchi
 <b>Deliberately out of scope:</b> vendoring gstack, re-implementing its skills, or having boost
 run <code>./setup</code>. The proposal is one registry row, one honest "self-installing" marker
 on the install path, and one coexistence test per hazard named above &mdash; scoped down on purpose,
-because the fit is a catalogue fit, not an engine fit.</p>
+because the fit is a catalogue fit, not an engine fit.</p></details>
         <div class="meta">
           <span class="m">Complexity <b>M</b></span>
           <span class="m">Impact <b>Med</b></span>

{boost_skill_cli-1.2.57 → boost_skill_cli-1.2.59}/scripts/build_registries.py

@@ -69,6 +69,25 @@ RETIRED = {
         "fails the scheduled eval-scale gate on its pinned corpus",
 }
 
+# Repos that ship their own installer and cannot be installed by copying
+# Markdown. boost's install is "copy the item's directory into the canonical
+# store and symlink it out"; for these the item is a thin entry point over a
+# build step boost does not run — `garrytan/gstack`'s `./setup` renders a
+# per-host variant from ten TypeScript configs and its `/browse` and `/qa`
+# skills drive a real Chromium behind Bun. Copying the Markdown alone produces
+# a skill that *looks* installed and cannot run, which is the failure mode
+# `store.source_dir_for` and `gitutil.materialize` exist to prevent and that
+# materializing cannot fix here: the missing step is `bun install`, not a
+# fetch. So the catalogue carries the repo (it is real, and worth searching)
+# and the value is the upstream command to run instead. boost does not own
+# bun, Chromium, or someone else's upgrade channel.
+SELF_INSTALLING = {
+    "garrytan/gstack":
+        "git clone --single-branch --depth 1 "
+        "https://github.com/garrytan/gstack.git ~/.claude/skills/gstack "
+        "&& cd ~/.claude/skills/gstack && ./setup",
+}
+
 # --- skills (SKILL.md registries) -------------------------------------------
 SKILLS = [
     ("travisvn/awesome-claude-skills", "meta", "Curated awesome-list of Claude Skills, tools, and resources", 60, "high"),
@@ -497,6 +516,7 @@ SKILLS = [
     ("Cold-IQ/ColdIQ-s-GTM-Skills", "marketing", "Cold email sequences, ABM messaging, buying signals, list building and deliverability", 90, "high"),
     ("LeadMagic/gtm-skills", "marketing", "CRM setup and hygiene (Salesforce, HubSpot, Attio), enrichment, AI SDR, ABM and lifecycle", 206, "high"),
     ("NEON-Rutger/B2B-revops-skills", "marketing", "B2B RevOps: CRM migration, lead routing, deal desk, pipeline visibility, ICP and forecasting", 38, "high"),
+    ("garrytan/gstack", "workflow", "Sprint-workflow slash commands — /ship, /qa, /review, /plan-*, /retro, /office-hours — self-installing across ten coding agents", 61, "high"),
 ]
 
 # --- rules (Cursor .mdc / .cursorrules / Windsurf) --------------------------
@@ -649,6 +669,10 @@ def rows(pairs, typ):
             "confidence": conf,
             "list_only": name in LIST_ONLY,
             "curated": True,
+            # Only where set: adding a null to every row would rewrite the
+            # whole generated file to say nothing about 460 registries.
+            **({"self_installing": SELF_INSTALLING[name]}
+               if name in SELF_INSTALLING else {}),
         }
 
 

{boost_skill_cli-1.2.57 → boost_skill_cli-1.2.59}/tests/functional/test_cli_quality.py

@@ -220,6 +220,46 @@ class TestDoctor:
                 "run `boost reinstall gone`") in r.out
 
 
+
+class TestDoctorSeesTheOtherTenant:
+    """boost is no longer the only writer of ~/.claude/settings.json.
+
+    `garrytan/gstack`'s `./setup` registers its own Stop hooks there and prunes
+    "dead gstack entries" on every run; boost prunes its own by the `# boost:`
+    marker. doctor must be able to *say* the other writer is present without
+    touching it — and must not count it, because boost will never remove it and
+    a health check that stays permanently red on something no command can clear
+    stops being read (the same rule as the foreign broken symlinks above it).
+    """
+
+    THEIRS = "~/.claude/skills/gstack/bin/gstack-timeline-stop"
+
+    def _write_foreign_hook(self):
+        from boost_cli.core import claude_settings as cs
+        cs.save("global", {"hooks": {"Stop": [
+            {"matcher": "*",
+             "hooks": [{"type": "command", "command": self.THEIRS}]}]}})
+
+    def test_doctor_reports_it_and_stays_green(self, boost, tapped):
+        self._write_foreign_hook()
+        r = boost("doctor")                       # the fixture asserts rc == 0
+        assert "not managed by boost" in r.out
+        assert "Stop" in r.out
+
+    def test_doctor_does_not_remove_it(self, boost, tapped):
+        from boost_cli.core import claude_settings as cs
+        self._write_foreign_hook()
+        boost("doctor")
+        blocks = cs.load("global")["hooks"]["Stop"]
+        assert blocks[0]["hooks"][0]["command"] == self.THEIRS
+
+    def test_a_clean_settings_file_says_nothing(self, boost, tapped):
+        # The line must be absent, not merely zero — doctor's output is read
+        # top to bottom and a "0 hooks not managed by boost" line is noise.
+        r = boost("doctor")
+        assert "not managed by boost" not in r.out
+
+
 # ── lint ─────────────────────────────────────────────────────────────────
 
 class TestLint: