boost-skill-cli 1.2.79__tar.gz → 1.2.81__tar.gz

{boost_skill_cli-1.2.79 → boost_skill_cli-1.2.81}/.vale/styles/config/vocabularies/boost/accept.txt

@@ -167,6 +167,7 @@ traceback
 tracebacks
 triaged
 triages
+truthy
 typosquat
 typosquatted
 unkilled

{boost_skill_cli-1.2.79 → boost_skill_cli-1.2.81}/CLAUDE.md

@@ -251,6 +251,26 @@ line coverage. Target `boost_cli/core` behavior with assertions, not just import
   a workflow is rendered per agent (TOML for Gemini, see
   `workflows.TOML_COMMAND_AGENTS`). Installing a rule therefore edits a file the
   user reads every session — treat it as more invasive than a skill, not less.
+- **A settable value is read at the type its `DEFAULTS` entry already declares.**
+  `core/typedvalue.py` turns `config.DEFAULTS` / `policy.DEFAULTS` into a
+  parser (`config.spec_for`, `policy.spec_for`), so a new key needs no
+  validation code — only a default of the right type. Four rules, each a bug
+  that shipped: **`bool` is tested before `int`**, because in Python a `bool`
+  *is* an `int` and the natural order types every `bool` key as a number;
+  **a list key never raises**, because its documented surface is a comma list,
+  which is what turns `policy set blocked_skills 42` from a stored `42` (and
+  `TypeError: argument of type 'int' is not iterable` out of the next install)
+  into `["42"]`; **a key `DEFAULTS` has never heard of keeps the old lenient
+  parse**, because `boost config set` accepts keys integrations invent; and
+  **`policy.load()` coerces and reports, it never raises** — a hand-edited
+  value it cannot read falls back to the default and is named by
+  `policy.invalid_values()` in `policy list`/`check`,
+  because a traceback from inside an install is not a remedy and a silent
+  substitution is not honest. The failure this closes was not the crash but the
+  inversion: `policy set pin_only no` stored the *string* `"no"`, which is
+  truthy, so boost reported "pin-only mode is on" and froze every install for a
+  user who had just turned it off.
+
 - **A long line is either chrome or data, and only chrome may be wrapped.**
   `out.wrap()` folds prose to the pane, and the emitters take it opt-in —
   `warn`/`info`/`dim`/`kv` accept `wrap=True` and each pays for its own prefix,

{boost_skill_cli-1.2.79/boost_skill_cli.egg-info → boost_skill_cli-1.2.81}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.2.79
+Version: 1.2.81
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License-Expression: Apache-2.0

{boost_skill_cli-1.2.79 → boost_skill_cli-1.2.81}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.2.79'
-__version_tuple__ = version_tuple = (1, 2, 79)
+__version__ = version = '1.2.81'
+__version_tuple__ = version_tuple = (1, 2, 81)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.2.79 → boost_skill_cli-1.2.81}/boost_cli/commands/configuration.py

@@ -41,6 +41,7 @@ from ..core import (
     selfupdate,
     serve,
     store,
+    typedvalue,
     util,
 )
 from ..core import output as out
@@ -50,6 +51,17 @@ from ._common import _s
 _tilde = paths.tilde
 
 
+def _bad_value(e: typedvalue.ValueTypeError, retry: str) -> BoostError:
+    """Frame a type mismatch as a user-facing error naming the expected type.
+
+    The whole point of the typed setters is that the user hears about a bad
+    value here, holding the keyboard, instead of as `exit 70` plus a crash
+    report out of the next `install`.
+    """
+    return BoostError("%s expects %s" % (e.key, e.expected),
+                      hint="got %s — try `%s`" % (json.dumps(e.raw), retry))
+
+
 # ---------------------------------------------------------------- config
 
 def cmd_config(argv) -> int:
@@ -100,6 +112,9 @@ def cmd_config(argv) -> int:
     if args.action == "set":
         try:
             config.set_value(args.key, args.value)
+        except typedvalue.ValueTypeError as e:
+            raise _bad_value(e, "boost config set %s <%s>"
+                             % (args.key, config.spec_for(args.key))) from e
         except TypeError as e:
             raise BoostError(str(e),
                             hint="the parent key holds a plain value — "
@@ -391,13 +406,30 @@ def cmd_create(argv) -> int:
 # ---------------------------------------------------------------- policy
 
 def _parse_policy_value(key: str, raw: str):
+    """Read `raw` at the key's declared type, or raise a framed BoostError.
+
+    Thin glue over `core.policy.parse_value` — the parsing itself lives in
+    core, where the mutation gate can reach it.
+    """
     try:
-        return json.loads(raw)
-    except (json.JSONDecodeError, TypeError):
-        pass
-    if isinstance(policy.DEFAULTS.get(key), list):
-        return [s.strip() for s in raw.split(",") if s.strip()]
-    return raw
+        return policy.parse_value(key, raw)
+    except typedvalue.ValueTypeError as e:
+        raise _bad_value(e, "boost policy set %s <%s>"
+                         % (key, policy.spec_for(key))) from e
+
+
+def _warn_invalid_policy_values() -> None:
+    """Name every stored policy value boost had to ignore, and why.
+
+    `policy.load()` substitutes the default for a value it cannot read at the
+    key's type, which is the right thing to do in the middle of an install and
+    the wrong thing to do silently. This is where it stops being silent.
+    """
+    for key, value, expected in policy.invalid_values():
+        out.warn("ignoring %s = %s in policy.json — expects %s"
+                 % (key, json.dumps(value), expected))
+        out.dim("  using the default; fix it with `boost policy set %s <%s>`"
+                % (key, policy.spec_for(key)))
 
 
 def cmd_policy(argv) -> int:
@@ -426,6 +458,7 @@ def cmd_policy(argv) -> int:
         pol = policy.load()
         print(json.dumps(pol, indent=2))
         if not args.json:
+            _warn_invalid_policy_values()
             diff = sorted(k for k in policy.DEFAULTS
                           if pol.get(k) != policy.DEFAULTS[k])
             out.dim("  modified from defaults: %s" % ", ".join(diff)
@@ -501,6 +534,7 @@ def cmd_policy(argv) -> int:
         }, indent=2))
         return 1 if violations else 0
 
+    _warn_invalid_policy_values()
     if pol["pin_only"]:
         out.info("pin-only mode is on — installs/updates are frozen"
                  + (" (%d unpinned item(s): %s)"
@@ -1012,11 +1046,17 @@ def cmd_schedule(argv) -> int:
 
 def cmd_serve(argv) -> int:
     """boost serve [--port N] [--host H] — thin wrapper over core.serve."""
+    # The default is read BEFORE argparse runs, so a hand-edited
+    # `serve.port: "abc"` used to crash even `boost serve --help` with a bare
+    # ValueError and exit 70. Framed, it is one line naming the key.
+    try:
+        default_port = config.get_int("serve.port", 8787) or 8787
+    except typedvalue.ValueTypeError as e:
+        raise _bad_value(e, "boost config set serve.port <int>") from e
     p = cliparse.parser(
         prog="boost serve",
         description="Browse the catalogue in a browser: search, facets and a tap graph")
-    p.add_argument("--port", type=int,
-                   default=int(config.get("serve.port", 8787) or 8787),
+    p.add_argument("--port", type=int, default=default_port,
                    help="port to listen on (default: config serve.port)")
     p.add_argument("--host", default="127.0.0.1",
                    help="address to bind (default: 127.0.0.1)")

{boost_skill_cli-1.2.79 → boost_skill_cli-1.2.81}/boost_cli/commands/taps.py

@@ -49,6 +49,18 @@ def _tap_catalog(args) -> int:
                     focus=focus)
 
 
+def _print_dry_run(pairs: list[tuple[str, str]]) -> int:
+    """Print what `--defaults`/SPEC would tap and return 0, tapping nothing.
+
+    Shares the format of the `--catalog --dry-run` table above so the flag
+    reads the same regardless of which branch of `cmd_tap` it modifies.
+    """
+    out.table(pairs, headers=("NAME", "URL"))
+    print()
+    out.dim("%d registries (dry run — nothing tapped)" % len(pairs))
+    return 0
+
+
 def _tap_all(urls: list[str], jobs: int | None,
              focus: dict[str, str] | None = None,
              pins: dict[str, str] | None = None,
@@ -122,7 +134,7 @@ def cmd_tap(argv) -> int:
     p.add_argument("--include-lists", action="store_true",
                    help="with --catalog: also tap awesome-list/index repos")
     p.add_argument("--dry-run", action="store_true",
-                   help="with --catalog: print what would be tapped, tap nothing")
+                   help="print what would be tapped, tap nothing")
     p.add_argument("--curated", action="store_true",
                    help="mark the tap as curated (★ in listings)")
     p.add_argument("--at", metavar="SHA",
@@ -142,14 +154,21 @@ def cmd_tap(argv) -> int:
     if args.catalog:
         rc |= _tap_catalog(args)
     if args.defaults:
-        # "items", not "skills": the defaults now carry rules and workflows, so
-        # a pure rules registry reported "257 skills" immediately after the
-        # README promised three kinds. `_tap_all` says items.
-        rc |= _tap_all([str(d["url"]) for d in config.DEFAULT_TAPS],
-                       jobs=args.jobs,
-                       focus={str(d["name"]): str(d.get("focus", ""))
-                              for d in config.DEFAULT_TAPS})
-    if len(args.spec) == 1:
+        if args.dry_run:
+            rc |= _print_dry_run([(str(d["name"]), str(d["url"]))
+                                  for d in config.DEFAULT_TAPS])
+        else:
+            # "items", not "skills": the defaults now carry rules and
+            # workflows, so a pure rules registry reported "257 skills"
+            # immediately after the README promised three kinds. `_tap_all`
+            # says items.
+            rc |= _tap_all([str(d["url"]) for d in config.DEFAULT_TAPS],
+                           jobs=args.jobs,
+                           focus={str(d["name"]): str(d.get("focus", ""))
+                                  for d in config.DEFAULT_TAPS})
+    if args.spec and args.dry_run:
+        rc |= _print_dry_run(registry.parse_specs(list(args.spec)))
+    elif len(args.spec) == 1:
         with spin.Spinner("cloning %s" % args.spec[0]):
             tap = registry.add(args.spec[0], curated=args.curated, at=args.at)
             entries = catalog.rebuild_tap(tap)

{boost_skill_cli-1.2.79 → boost_skill_cli-1.2.81}/boost_cli/core/config.py

@@ -7,7 +7,7 @@ import json
 from copy import deepcopy
 from typing import Any
 
-from . import paths, util
+from . import paths, typedvalue, util
 
 DEFAULTS = {
     "agents": {
@@ -269,12 +269,43 @@ def get(dotted: str, default=None):
     return deepcopy(node)
 
 
+def spec_for(dotted: str) -> str:
+    """The value type of a dotted key, derived from :data:`DEFAULTS`.
+
+    A key DEFAULTS does not describe types as :data:`typedvalue.ANY`: `boost
+    config set` accepts keys boost has never heard of (integrations write their
+    own), and inventing a type for those would refuse values that work today.
+    """
+    node: Any = DEFAULTS
+    for part in dotted.split("."):
+        if not isinstance(node, dict) or part not in node:
+            return typedvalue.ANY
+        node = node[part]
+    return typedvalue.spec_for(node)
+
+
+def get_int(dotted: str, default: int) -> int:
+    """Read a config key as an int, or raise :class:`typedvalue.ValueTypeError`.
+
+    The consumers of a numeric setting used to call `int()` on whatever was
+    stored, so a hand-edited `serve.port: "abc"` crashed `boost serve --help`
+    with a traceback and exit 70 — before argparse had even run. Callers catch
+    this and frame it instead.
+    """
+    value = get(dotted, default)
+    if value is None:
+        return default
+    return typedvalue.adapt(dotted, value, typedvalue.INT)
+
+
 def set_value(dotted: str, raw: str) -> None:
-    """Set a dotted key. Values parse as JSON when possible, else string."""
-    try:
-        value = json.loads(raw)
-    except (json.JSONDecodeError, TypeError):
-        value = raw
+    """Set a dotted key, reading the value at the type :data:`DEFAULTS` declares.
+
+    Raises :class:`typedvalue.ValueTypeError` when the text cannot be read at
+    that type. Keys with no default keep the old lenient behaviour: JSON when
+    it parses, the string otherwise.
+    """
+    value = typedvalue.coerce(dotted, raw, spec_for(dotted))
     cfg = load()
     node: Any = cfg
     parts = dotted.split(".")

{boost_skill_cli-1.2.79 → boost_skill_cli-1.2.81}/boost_cli/core/policy.py

@@ -10,7 +10,7 @@ from __future__ import annotations
 import contextlib
 import json
 
-from . import config, paths
+from . import config, paths, typedvalue
 
 DEFAULTS = {
     "blocked_skills": [],      # names never allowed
@@ -31,20 +31,80 @@ DEFAULTS = {
     "require_signed_taps": False,
 }
 
+# Per-key value types, derived from DEFAULTS so the two can never disagree.
+# `max_skills` is the one key whose default (None) names no type, so it says
+# so explicitly: a cap is a number, and "no cap" is null.
+VALUE_TYPES: dict[str, str] = {k: typedvalue.spec_for(v) for k, v in DEFAULTS.items()}
+VALUE_TYPES["max_skills"] = typedvalue.INT_OR_NONE
+
+
+def spec_for(key: str) -> str:
+    """The value type of a policy key; :data:`typedvalue.ANY` if unknown."""
+    return VALUE_TYPES.get(key, typedvalue.ANY)
+
+
+def parse_value(key: str, raw: str):
+    """Read a typed value for `key` out of the string a user typed.
+
+    Raises :class:`typedvalue.ValueTypeError` when the text cannot be read at
+    the key's type — at the setter, where the user can still fix it, rather
+    than as a traceback out of the middle of the next install.
+    """
+    return typedvalue.coerce(key, raw, spec_for(key))
+
+
+def _read_file() -> dict:
+    """The raw contents of policy.json; ``{}`` when missing or unparseable."""
+    p = paths.policy_path()
+    if not p.exists():
+        return {}
+    with contextlib.suppress(json.JSONDecodeError, OSError):
+        data = json.loads(p.read_text(encoding="utf-8"))
+        if isinstance(data, dict):
+            return data
+    return {}
+
 
 def load() -> dict:
     """Return the effective policy: DEFAULTS overlaid with policy.json.
 
-    A missing or unparseable file silently yields the defaults.
+    A missing or unparseable file silently yields the defaults. Every stored
+    value is read at its declared type, so a hand-edited (or older-boost)
+    ``"pin_only": "no"`` is the boolean the user meant and not a truthy string
+    that freezes the machine. A value that cannot be read at its type falls
+    back to the default and is reported by :func:`invalid_values` — never
+    raised into the middle of an install, and never silently obeyed either.
     """
-    p = paths.policy_path()
     base = DEFAULTS.copy()
-    if p.exists():
-        with contextlib.suppress(json.JSONDecodeError, OSError):
-            base.update(json.loads(p.read_text(encoding="utf-8")))
+    for key, value in _read_file().items():
+        if key not in DEFAULTS:
+            base[key] = value
+            continue
+        try:
+            base[key] = typedvalue.adapt(key, value, spec_for(key))
+        except typedvalue.ValueTypeError:
+            base[key] = DEFAULTS[key]
     return base
 
 
+def invalid_values() -> list[tuple[str, object, str]]:
+    """Stored policy values that could not be read at their declared type.
+
+    Each row is ``(key, stored value, expected phrase)``. :func:`load` has
+    already substituted the default for these, so this is what lets `boost
+    policy` say which keys are being ignored and why.
+    """
+    bad: list[tuple[str, object, str]] = []
+    for key, value in _read_file().items():
+        if key not in DEFAULTS:
+            continue
+        try:
+            typedvalue.adapt(key, value, spec_for(key))
+        except typedvalue.ValueTypeError as e:
+            bad.append((key, value, e.expected))
+    return bad
+
+
 def save(pol: dict) -> None:
     """Write `pol` to policy.json, restricted to the known DEFAULTS keys.
 

{boost_skill_cli-1.2.79 → boost_skill_cli-1.2.81}/boost_cli/core/registry.py

@@ -125,6 +125,16 @@ def _checked(name: str, url: str, spec: str) -> tuple[str, str]:
     return (name, url)
 
 
+def parse_specs(specs: list[str]) -> list[tuple[str, str]]:
+    """Parse each spec to (name, url) via `parse_spec`, touching nothing.
+
+    Used by `tap --dry-run` to preview targets without cloning or writing
+    config — `parse_spec` is already pure (a directory stat at worst), so the
+    only job here is applying it across a SPEC list in order.
+    """
+    return [parse_spec(spec) for spec in specs]
+
+
 def list_taps() -> list[Tap]:
     """Configured taps from config.json.
 

boost_skill_cli-1.2.81/boost_cli/core/typedvalue.py

@@ -0,0 +1,217 @@
+# Copyright the boost contributors.
+# SPDX-License-Identifier: Apache-2.0
+"""Read a command-line string at the type its key already declares.
+
+``boost config set`` and ``boost policy set`` both took *any* string for *any*
+known key and stored whatever ``json.loads`` made of it. The damage landed
+later and elsewhere: ``policy set max_skills abc`` exited 0, and the next
+``install`` died with ``ValueError: invalid literal for int()`` and a crash
+report. The nastiest shape was not a crash at all — ``policy set pin_only no``
+stored the *string* ``"no"``, which is truthy, so boost reported "pin-only mode
+is on" and froze every install for a user who had just turned it off.
+
+Both modules already ship a ``DEFAULTS`` table, and a default value names its
+own type. This module turns that table into a parser: ``coerce("pin_only",
+"no", BOOL)`` is ``False``, and ``coerce("max_skills", "abc", INT_OR_NONE)``
+raises :class:`ValueTypeError` at the setter instead of exit 70 at the next
+install.
+
+The one deliberate asymmetry is :data:`LIST`, which never raises. A list key's
+documented surface is a comma list (``blocked_skills a,b``), so anything that
+is not already a JSON array is split on commas rather than refused — which is
+also what turns ``blocked_skills 42`` from a stored ``42`` (and a later
+``TypeError: argument of type 'int' is not iterable``) into ``["42"]``.
+"""
+from __future__ import annotations
+
+import json
+from typing import Any
+
+#: Spec names. A spec is a plain string so the tables that use it stay readable
+#: and JSON-dumpable, and so it can be printed straight into a hint the user
+#: retypes (``boost policy set pin_only <bool>``). An unrecognised spec is the
+#: lenient :data:`ANY`, never an error — see :func:`describe` for why.
+BOOL = "bool"
+INT = "int"
+INT_OR_NONE = "int-or-null"
+LIST = "list"
+STR = "str"
+DICT = "dict"
+ANY = "any"
+
+#: Strings accepted for a true boolean, lower-cased and stripped.
+TRUE_WORDS = frozenset({"true", "yes", "on", "1"})
+#: Strings accepted for a false boolean. ``no``/``off``/``0`` are the three
+#: that used to store a truthy string and invert the setting.
+FALSE_WORDS = frozenset({"false", "no", "off", "0"})
+#: Strings accepted as "no value" for :data:`INT_OR_NONE`.
+NONE_WORDS = frozenset({"", "null", "none"})
+
+_DESCRIPTIONS = {
+    BOOL: "a boolean (true/false, yes/no, on/off, 1/0)",
+    INT: "a whole number",
+    INT_OR_NONE: "a whole number, or null for no limit",
+    LIST: "a comma-separated list, or a JSON array",
+    STR: "a string",
+    DICT: "a JSON object",
+    ANY: "any value",
+}
+
+
+class ValueTypeError(ValueError):
+    """A raw string that cannot be read at its key's declared type.
+
+    Carries the parts a caller needs to word its own error: which ``key`` was
+    being set, the ``raw`` value that failed, and an ``expected`` phrase naming
+    the type in the words a user can retype. ``raw`` is a string when the value
+    was typed and can be any JSON scalar when it was read back off disk.
+    """
+
+    def __init__(self, key: str, raw: Any, spec: str):
+        self.key = key
+        self.raw = raw
+        self.spec = spec
+        self.expected = describe(spec)
+        super().__init__("%s expects %s, got %r" % (key, self.expected, raw))
+
+
+def describe(spec: str) -> str:
+    """The human phrase for a spec, e.g. ``"a whole number"``.
+
+    An unknown spec describes as :data:`ANY` rather than raising: a wrong hint
+    must never be the thing that turns a working setter into a crash.
+    """
+    return _DESCRIPTIONS.get(spec, _DESCRIPTIONS[ANY])
+
+
+def spec_for(default: Any) -> str:
+    """Derive a spec from a key's default value.
+
+    ``bool`` is tested before ``int`` on purpose — ``bool`` is a subclass of
+    ``int``, so the natural order would type every boolean key as a number and
+    happily store ``pin_only = 2``. ``None`` carries no type and yields
+    :data:`ANY`; a key defaulting to ``None`` that *does* have a type (policy's
+    ``max_skills``) declares it explicitly in its own table.
+    """
+    if isinstance(default, bool):
+        return BOOL
+    if isinstance(default, int):
+        return INT
+    if isinstance(default, list):
+        return LIST
+    if isinstance(default, dict):
+        return DICT
+    if isinstance(default, str):
+        return STR
+    return ANY
+
+
+def _as_bool(key: str, raw: str) -> bool:
+    word = raw.strip().lower()
+    if word in TRUE_WORDS:
+        return True
+    if word in FALSE_WORDS:
+        return False
+    raise ValueTypeError(key, raw, BOOL)
+
+
+def _as_int(key: str, raw: str, spec: str) -> int:
+    try:
+        return int(raw.strip())
+    except (TypeError, ValueError) as e:
+        raise ValueTypeError(key, raw, spec) from e
+
+
+def _as_list(raw: str) -> list:
+    """A JSON array as written, else the comma split. Never raises."""
+    try:
+        parsed = json.loads(raw)
+    except (json.JSONDecodeError, TypeError):
+        parsed = None
+    if isinstance(parsed, list):
+        return parsed
+    return [s.strip() for s in raw.split(",") if s.strip()]
+
+
+def _as_dict(key: str, raw: str) -> dict:
+    try:
+        parsed = json.loads(raw)
+    except (json.JSONDecodeError, TypeError) as e:
+        raise ValueTypeError(key, raw, DICT) from e
+    if not isinstance(parsed, dict):
+        raise ValueTypeError(key, raw, DICT)
+    return parsed
+
+
+def _as_any(raw: str) -> Any:
+    """The old lenient behaviour: JSON when it parses, the string otherwise.
+
+    Kept for keys no ``DEFAULTS`` table describes — ``boost config set`` accepts
+    keys boost has never heard of, and inventing a type for those would refuse
+    values that work today.
+    """
+    try:
+        return json.loads(raw)
+    except (json.JSONDecodeError, TypeError):
+        return raw
+
+
+def coerce(key: str, raw: str, spec: str) -> Any:
+    """Read ``raw`` at ``spec``, or raise :class:`ValueTypeError`.
+
+    ``raw`` is what argv handed over, so it is always a string here; the
+    already-typed sibling for values read back off disk is :func:`adapt`.
+    """
+    if spec == BOOL:
+        return _as_bool(key, raw)
+    if spec == INT:
+        return _as_int(key, raw, INT)
+    if spec == INT_OR_NONE:
+        return None if raw.strip().lower() in NONE_WORDS else _as_int(key, raw, INT_OR_NONE)
+    if spec == LIST:
+        return _as_list(raw)
+    if spec == STR:
+        return raw
+    if spec == DICT:
+        return _as_dict(key, raw)
+    return _as_any(raw)
+
+
+def matches(value: Any, spec: str) -> bool:
+    """True when an already-typed ``value`` is acceptable for ``spec``.
+
+    Deliberately stricter than :func:`coerce`: this judges a value that is
+    already sitting in a JSON file, where ``"no"`` is a string and not a
+    keystroke. ``bool`` is rejected for the numeric specs for the same reason
+    :func:`spec_for` tests it first.
+    """
+    if spec == BOOL:
+        return isinstance(value, bool)
+    if spec == INT:
+        return isinstance(value, int) and not isinstance(value, bool)
+    if spec == INT_OR_NONE:
+        return value is None or (isinstance(value, int) and not isinstance(value, bool))
+    if spec == LIST:
+        return isinstance(value, list)
+    if spec == STR:
+        return isinstance(value, str)
+    if spec == DICT:
+        return isinstance(value, dict)
+    return True
+
+
+def adapt(key: str, value: Any, spec: str) -> Any:
+    """Return ``value`` at ``spec``, or raise :class:`ValueTypeError`.
+
+    The entry point for values read back from a file rather than typed: a
+    value that already matches is returned untouched, and a *string* gets one
+    chance to be re-read through :func:`coerce`, which is what rescues a
+    ``"pin_only": "no"`` written by an older boost or by hand. Anything else
+    (a list where a number belongs) is refused — guessing there would be
+    inventing data, not reading it.
+    """
+    if matches(value, spec):
+        return value
+    if isinstance(value, str):
+        return coerce(key, value, spec)
+    raise ValueTypeError(key, value, spec)

{boost_skill_cli-1.2.79 → boost_skill_cli-1.2.81/boost_skill_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.2.79
+Version: 1.2.81
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License-Expression: Apache-2.0

{boost_skill_cli-1.2.79 → boost_skill_cli-1.2.81}/boost_skill_cli.egg-info/SOURCES.txt

@@ -107,6 +107,7 @@ boost_cli/core/stackprobe.py
 boost_cli/core/staleness.py
 boost_cli/core/store.py
 boost_cli/core/trustaudit.py
+boost_cli/core/typedvalue.py
 boost_cli/core/typosquat.py
 boost_cli/core/updatediff.py
 boost_cli/core/util.py
@@ -933,6 +934,7 @@ tests/unit/test_tap_pins.py
 tests/unit/test_token_parity.py
 tests/unit/test_toolchain_lock.py
 tests/unit/test_trustaudit.py
+tests/unit/test_typedvalue.py
 tests/unit/test_typosquat.py
 tests/unit/test_updatediff.py
 tests/unit/test_util.py

{boost_skill_cli-1.2.79 → boost_skill_cli-1.2.81}/docs/commands.html

@@ -650,7 +650,7 @@
           <div class="arg"><code>--category CATEGORY</code><span>with --catalog: restrict to one category</span></div>
           <div class="arg"><code>--limit N</code><span>with --catalog: only the top N registries by est. size</span></div>
           <div class="arg"><code>--include-lists</code><span>with --catalog: also tap awesome-list/index repos</span></div>
-          <div class="arg"><code>--dry-run</code><span>with --catalog: print what would be tapped, tap nothing</span></div>
+          <div class="arg"><code>--dry-run</code><span>print what would be tapped, tap nothing</span></div>
           <div class="arg"><code>--curated</code><span>mark the tap as curated (★ in listings)</span></div>
           <div class="arg"><code>--at SHA</code><span>pin the clone to one 40-character commit, as a published vector shard requires</span></div>
           <div class="arg"><code>--jobs N</code><span>clone this many registries at once (default 8, max 16)</span></div>