boost-skill-cli 1.2.89__tar.gz → 1.2.90__tar.gz

{boost_skill_cli-1.2.89/boost_skill_cli.egg-info → boost_skill_cli-1.2.90}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.2.89
+Version: 1.2.90
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License-Expression: Apache-2.0

{boost_skill_cli-1.2.89 → boost_skill_cli-1.2.90}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.2.89'
-__version_tuple__ = version_tuple = (1, 2, 89)
+__version__ = version = '1.2.90'
+__version_tuple__ = version_tuple = (1, 2, 90)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.2.89 → boost_skill_cli-1.2.90}/boost_cli/commands/hooks.py

@@ -129,12 +129,15 @@ def _add(args) -> int:
     if event not in hookhost.events(host):
         out.warn("'%s' is not a known %s hook event — adding anyway"
                  % (event, hookhost.event_label(host)))
-    cs.add_hook(scope, event, args.name, args.command,
-                matcher=args.matcher, timeout=args.timeout, host=host)
+    snapshot = cs.add_hook(scope, event, args.name, args.command,
+                           matcher=args.matcher, timeout=args.timeout,
+                           host=host)
     journal.log("hook-add", args.name, scope=scope, event=event, host=host)
     out.ok("added %s hook '%s' (%s) → %s"
            % (event, args.name, _where(host, scope), args.command))
     out.dim("  settings: %s" % cs.settings_path(scope, host=host))
+    if snapshot is not None:
+        out.dim("  backup:   %s" % snapshot)
     return 0
 
 

{boost_skill_cli-1.2.89 → boost_skill_cli-1.2.90}/boost_cli/commands/intelligence.py

@@ -28,6 +28,7 @@ from ..core import (
     gitutil,
     imperative,
     journal,
+    jsonstate,
     lockfile,
     paths,
     registry,
@@ -95,17 +96,26 @@ def _bump_patch(v: str) -> str:
 
 def _load_state(fname: str, default: dict) -> dict:
     p = paths.state_dir() / fname
-    if not p.exists():
-        return json.loads(json.dumps(default))
-    try:
-        return json.loads(p.read_text(encoding="utf-8"))
-    except (json.JSONDecodeError, OSError):
+    data, err = jsonstate.read_object(p)
+    if err:
+        # stderr unconditionally: some callers (`context status --json`) read
+        # this before deciding whether they're printing JSON to stdout, and a
+        # warning has no business inside that payload.
+        out.warn("%s — reading as the default; the file is left on disk but "
+                 "the next write here replaces it" % err, stream=sys.stderr)
+    if data is None:
         return json.loads(json.dumps(default))
+    return data
 
 
 def _save_state(fname: str, data: dict) -> None:
     paths.ensure_dirs()
-    (paths.state_dir() / fname).write_text(json.dumps(data, indent=2) + "\n", encoding="utf-8")
+    p = paths.state_dir() / fname
+    if jsonstate.is_corrupt(p):
+        dest = jsonstate.quarantine(p)
+        out.warn("%s was corrupt and has been moved to %s before writing "
+                 "the new file" % (p, dest), stream=sys.stderr)
+    p.write_text(json.dumps(data, indent=2) + "\n", encoding="utf-8")
 
 
 def _save_generated_fallback(name: str, text: str, reason: str) -> None:

{boost_skill_cli-1.2.89 → boost_skill_cli-1.2.90}/boost_cli/commands/quality.py

@@ -266,7 +266,7 @@ _DRIFT_ROLE = {"in-sync": "success", "local-edits": "warn",
                "quarantined": "muted"}
 
 
-def _drift_hint(name: str, status: str) -> str:
+def _drift_hint(name: str, status: str, tap: str = "") -> str:
     if status == "quarantined":
         return "boost quarantine --release %s to restore" % name
     if status == "upstream-moved":
@@ -274,7 +274,10 @@ def _drift_hint(name: str, status: str) -> str:
     if status == "local-edits":
         return "boost reinstall %s to discard local edits" % name
     if status == "source-missing":
-        return "boost update"
+        # `boost update` only refreshes configured taps. When the entry's
+        # tap has been untapped, that command is a guaranteed no-op — the
+        # only remedy that can actually restore the source is re-tapping it.
+        return "boost update" if registry.is_tapped(tap) else "boost tap %s" % tap
     if status == "store-missing":
         return "boost heal"
     return ""
@@ -861,7 +864,7 @@ def cmd_drift(argv):
         status = (_drift_status(name, entry) if kind == "skill"
                   else _drift_status_materialized(kind, name, entry))
         rows.append({"name": name, "kind": kind, "status": status,
-                     "hint": _drift_hint(name, status)})
+                     "hint": _drift_hint(name, status, entry.get("tap", ""))})
     if args.json:
         print(json.dumps({"skills": rows}))
         return 0

{boost_skill_cli-1.2.89 → boost_skill_cli-1.2.90}/boost_cli/commands/team.py

@@ -9,12 +9,14 @@ import platform
 import shutil
 import stat
 import urllib.parse
+from typing import Any
 
 from .. import cliparse
 from ..core import (
     catalog,
     complete,
     journal,
+    jsonstate,
     lockfile,
     paths,
     registry,
@@ -258,15 +260,20 @@ def cmd_profile(argv) -> int:
         p.error("%s needs a profile NAME" % args.action)
 
     if args.action == "list":
-        profiles = []
+        profiles: list[dict[str, Any]] = []
         for f in sorted(paths.profiles_dir().glob("*.json")):
-            try:
-                data = json.loads(f.read_text(encoding="utf-8"))
-            except (json.JSONDecodeError, OSError):
+            data, _err = jsonstate.read_object(f)
+            if data is None:
+                # Surfaced rather than skipped: a corrupt profile used to be
+                # invisible here yet still block `profile delete` (it parsed
+                # the file again as an existence check) — see `delete` below.
+                profiles.append({"name": f.stem, "skills": None,
+                                 "saved": None, "unreadable": True})
                 continue
             profiles.append({"name": data.get("name", f.stem),
                              "skills": len(data.get("skills", {})),
-                             "saved": data.get("saved", "?")})
+                             "saved": data.get("saved", "?"),
+                             "unreadable": False})
         if args.json:
             print(json.dumps(profiles, indent=2))
             return 0
@@ -274,8 +281,11 @@ def cmd_profile(argv) -> int:
             out.info("no profiles saved")
             out.info(out.role("snapshot the current setup: `boost profile save daily`", "muted"))
             return 0
-        rows = [(pr["name"], str(pr["skills"]), util.rel_time(pr["saved"]))
-                for pr in profiles]
+        rows = [(pr["name"],
+                str(pr["skills"]) if not pr["unreadable"] else "?",
+                util.rel_time(pr["saved"]) if not pr["unreadable"]
+                else out.role("(unreadable)", "danger"))
+               for pr in profiles]
         out.table(rows, headers=("PROFILE", "SKILLS", "SAVED"))
         return 0
 
@@ -347,7 +357,9 @@ def cmd_profile(argv) -> int:
         return 0
 
     if args.action == "delete":
-        _load_profile(args.name)  # existence check
+        if not _profile_path(args.name).exists():
+            raise BoostError("no profile named %s" % args.name,
+                            hint="list profiles with `boost profile list`")
         if not out.confirm("delete profile %s?" % args.name):
             out.info("cancelled")
             return 1

{boost_skill_cli-1.2.89 → boost_skill_cli-1.2.90}/boost_cli/core/claude_settings.py

@@ -32,10 +32,11 @@ from __future__ import annotations
 
 import contextlib
 import json
+import sys
 from pathlib import Path
 
 from ..errors import BoostError
-from . import hookhost, paths, util
+from . import hookhost, jsonstate, output, paths, util
 
 SCOPES = ("global", "project")
 MARKER = "# boost:"
@@ -66,27 +67,39 @@ def _history_dir() -> Path:
 
 def load(scope: str, project_dir: Path | None = None,
          host: str = hookhost.CLAUDE) -> dict:
-    """Parse a scope's settings.json ({} if missing or corrupt)."""
+    """Parse a scope's settings.json ({} if missing or corrupt).
+
+    A file that exists but fails to parse is warned about by name: it stays
+    on disk untouched by this read, but `save` treats an empty `{}` as this
+    scope's *whole* settings from here on, so silently swallowing the error
+    is how a hooks-only settings.json used to eat the user's `permissions`
+    and `model` keys on the next `hooks add`.
+    """
     p = settings_path(scope, project_dir, host)
-    if not p.exists():
-        return {}
-    try:
-        data = json.loads(p.read_text(encoding="utf-8"))
-    except (json.JSONDecodeError, OSError):
-        return {}
-    return data if isinstance(data, dict) else {}
+    data, err = jsonstate.read_object(p)
+    if err:
+        output.warn(
+            "%s — reading as empty; the file is left on disk but the next "
+            "write here replaces its contents (a snapshot lands in %s "
+            "first)" % (err, _history_dir()), stream=sys.stderr)
+    return data if data is not None else {}
 
 
 def save(scope: str, data: dict, project_dir: Path | None = None,
-         host: str = hookhost.CLAUDE) -> None:
+        host: str = hookhost.CLAUDE) -> Path | None:
     """Write a scope's settings.json, snapshotting the prior version first.
 
     Snapshots are named ``<host prefix><scope>-<stamp>.json``. Claude's prefix
     is empty, so its history filenames are exactly what they always were and a
     Gemini write cannot land on top of one.
+
+    Returns the snapshot path, or None when there was no prior file to
+    snapshot — callers that just replaced a scope's settings (`hooks add`)
+    use this to tell the user where the previous version went.
     """
     p = settings_path(scope, project_dir, host)
     p.parent.mkdir(parents=True, exist_ok=True)
+    dest = None
     if p.exists():
         hist = _history_dir()
         hist.mkdir(parents=True, exist_ok=True)
@@ -100,6 +113,7 @@ def save(scope: str, data: dict, project_dir: Path | None = None,
         dest.write_text(p.read_text(encoding="utf-8"), encoding="utf-8")
         _prune_history()
     p.write_text(json.dumps(data, indent=2) + "\n", encoding="utf-8")
+    return dest
 
 
 def _prune_history() -> None:
@@ -135,7 +149,7 @@ def _hook_name(command: str) -> str | None:
 def add_hook(scope: str, event: str, name: str, command: str,
              matcher: str | None = None, timeout: int = 10,
              project_dir: Path | None = None,
-             host: str = hookhost.CLAUDE) -> None:
+             host: str = hookhost.CLAUDE) -> Path | None:
     """Idempotently install a boost-managed hook (replaces same-named entry).
 
     ``timeout`` is in **seconds** whatever the host; ``hookhost.hook_entry``
@@ -143,6 +157,9 @@ def add_hook(scope: str, event: str, name: str, command: str,
     must already be spelled the way ``host`` spells it — translating is the
     command layer's job, because a Claude event with no Gemini counterpart has
     to be refused out loud rather than silently dropped here.
+
+    Returns `save`'s snapshot path (or None) so the caller can tell the user
+    where the pre-edit settings.json went.
     """
     data = load(scope, project_dir, host)
     event_list = data.setdefault("hooks", {}).setdefault(event, [])
@@ -154,7 +171,7 @@ def add_hook(scope: str, event: str, name: str, command: str,
     block["hooks"] = [hookhost.hook_entry(host, _tag(command, name), timeout,
                                           name=name)]
     event_list.append(block)
-    save(scope, data, project_dir, host)
+    return save(scope, data, project_dir, host)
 
 
 def remove_hook(scope: str, event: str, name: str,

{boost_skill_cli-1.2.89 → boost_skill_cli-1.2.90}/boost_cli/core/config.py

@@ -4,10 +4,11 @@
 from __future__ import annotations
 
 import json
+import sys
 from copy import deepcopy
 from typing import Any
 
-from . import paths, typedvalue, util
+from . import jsonstate, output, paths, typedvalue, util
 
 DEFAULTS = {
     "agents": {
@@ -201,13 +202,20 @@ def _stat_stamp(p: Any) -> tuple:
     return (str(p), st.st_mtime_ns, st.st_size)
 
 
+def _warn_corrupt(err: str) -> None:
+    output.warn(
+        "%s — reading as empty for this command; the file on disk is left "
+        "untouched, but the next `config set`/`config unset` will move it "
+        "aside to '<name>.corrupt' before writing a fresh one" % err,
+        stream=sys.stderr)
+
+
 def _read() -> dict:
     p = paths.config_path()
-    if not p.exists():
-        return deepcopy(DEFAULTS)
-    try:
-        user = json.loads(p.read_text(encoding="utf-8"))
-    except (json.JSONDecodeError, OSError):
+    user, err = jsonstate.read_object(p)
+    if err:
+        _warn_corrupt(err)
+    if user is None:
         return deepcopy(DEFAULTS)
     return _merge(DEFAULTS, user)
 
@@ -217,16 +225,14 @@ def _read_raw() -> dict:
 
     A missing or corrupt file reads as no overrides — the same "absent" the
     merged view falls back to, so a caller walking this dict never has to
-    special-case the file not existing.
+    special-case the file not existing. Corruption is warned about, not
+    silenced: see :func:`_warn_corrupt`.
     """
     p = paths.config_path()
-    if not p.exists():
-        return {}
-    try:
-        data = json.loads(p.read_text(encoding="utf-8"))
-    except (json.JSONDecodeError, OSError):
-        return {}
-    return data if isinstance(data, dict) else {}
+    data, err = jsonstate.read_object(p)
+    if err:
+        _warn_corrupt(err)
+    return data if data is not None else {}
 
 
 def _cached() -> dict:
@@ -249,10 +255,21 @@ def load() -> dict:
 
 
 def save(cfg: dict) -> None:
-    """Atomically write `cfg` to `~/.boost/config.json`, creating dirs first."""
+    """Atomically write `cfg` to `~/.boost/config.json`, creating dirs first.
+
+    A config.json that exists but fails to parse is quarantined to
+    `config.json.corrupt` first, so this never overwrites bytes the read path
+    already warned about with a fresh file built from an in-memory view that
+    silently dropped them — see `jsonstate.quarantine`.
+    """
     paths.ensure_dirs()
+    p = paths.config_path()
+    if jsonstate.is_corrupt(p):
+        dest = jsonstate.quarantine(p)
+        output.warn("%s was corrupt and has been moved to %s before writing "
+                     "the new config" % (p, dest), stream=sys.stderr)
     util.atomic_write_text(
-        paths.config_path(), json.dumps(cfg, indent=2, sort_keys=False) + "\n")
+        p, json.dumps(cfg, indent=2, sort_keys=False) + "\n")
 
 
 def get(dotted: str, default=None):

boost_skill_cli-1.2.90/boost_cli/core/jsonstate.py

@@ -0,0 +1,76 @@
+# Copyright the boost contributors.
+# SPDX-License-Identifier: Apache-2.0
+"""Corruption-aware read/quarantine for boost's small JSON state files.
+
+Several files under ``~/.boost`` and each agent's dotdir (``config.json``,
+``settings.json``, ``context.json``, a saved profile, ...) are read as "the
+merged view, or defaults/empty if the file is missing" and then, on the next
+write, replaced outright. Before this module every one of those read sites
+folded "missing" and "exists but fails to parse" into the same branch, so a
+truncated write or a hand-edited trailing comma degraded to an empty object
+with no warning — and the next save then overwrote the corrupt bytes with a
+fresh file built from that empty view, discarding whatever was still sitting
+on disk. :func:`read_object` keeps those two cases apart so a caller can warn
+on the one that means something was actually lost; :func:`quarantine` gives a
+writer a way to get the bad bytes out of the way, rather than over them,
+before it writes the replacement.
+"""
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+
+def read_object(path: Path) -> tuple[dict | None, str | None]:
+    """Parse `path` as a JSON object.
+
+    Returns ``(data, None)`` when the file is missing (``data`` is ``None``)
+    or holds a valid JSON object. Returns ``(None, message)`` when the file
+    exists but can't be read as one — unreadable, invalid JSON, or valid JSON
+    that isn't an object — where ``message`` names the file and the
+    underlying error so a caller can warn instead of quietly treating
+    corruption the same as "nothing here yet".
+    """
+    if not path.exists():
+        return None, None
+    try:
+        text = path.read_text(encoding="utf-8")
+    except OSError as exc:
+        return None, "%s: %s" % (path, exc)
+    try:
+        data = json.loads(text)
+    except json.JSONDecodeError as exc:
+        return None, "%s: invalid JSON (%s)" % (path, exc)
+    if not isinstance(data, dict):
+        return None, "%s: expected a JSON object, found %s" % (
+            path, type(data).__name__)
+    return data, None
+
+
+def is_corrupt(path: Path) -> bool:
+    """True when `path` exists but :func:`read_object` can't parse it.
+
+    A missing file is not corrupt — callers that only care about "is there a
+    bad file sitting here" (rather than the error text) use this instead of
+    unpacking the tuple.
+    """
+    _, err = read_object(path)
+    return err is not None
+
+
+def quarantine(path: Path) -> Path:
+    """Move a corrupt `path` aside so a fresh write can land on its name
+    without destroying the bad bytes underneath it.
+
+    Picks `<name>.corrupt`, or `<name>.corrupt.N` for the first `N >= 2` that
+    doesn't already exist, so repeated corruption never overwrites an earlier
+    quarantined copy. Returns the destination. Caller's job to have already
+    established `path` is worth quarantining; this itself doesn't parse it.
+    """
+    dest = path.with_name(path.name + ".corrupt")
+    n = 2
+    while dest.exists():
+        dest = path.with_name("%s.corrupt.%d" % (path.name, n))
+        n += 1
+    path.rename(dest)
+    return dest

{boost_skill_cli-1.2.89 → boost_skill_cli-1.2.90}/boost_cli/core/registry.py

@@ -182,6 +182,18 @@ def get(name: str) -> Tap:
                     else "list taps with `boost taps`")
 
 
+def is_tapped(name: str) -> bool:
+    """True if `name` is a currently configured tap's exact ``Tap.name``.
+
+    Exact match only, unlike ``get()``'s shorthand/ambiguity tiering: a lock
+    entry's ``tap`` field always records the full ``owner/repo`` name a skill
+    was installed from, so callers checking "is this entry's tap still
+    tapped?" want a plain membership test, not a fuzzy lookup that could
+    raise on an unrelated ambiguous shorthand.
+    """
+    return any(t.name == name for t in list_taps())
+
+
 def add(spec: str, curated: bool = False, at: str | None = None) -> Tap:
     """Parse `spec`, shallow-clone it, and record the tap in config.
 

{boost_skill_cli-1.2.89 → boost_skill_cli-1.2.90/boost_skill_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.2.89
+Version: 1.2.90
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License-Expression: Apache-2.0

{boost_skill_cli-1.2.89 → boost_skill_cli-1.2.90}/boost_skill_cli.egg-info/SOURCES.txt

@@ -81,6 +81,7 @@ boost_cli/core/injectscan.py
 boost_cli/core/installscan.py
 boost_cli/core/integrity.py
 boost_cli/core/journal.py
+boost_cli/core/jsonstate.py
 boost_cli/core/localembed.py
 boost_cli/core/lockfile.py
 boost_cli/core/logs.py
@@ -826,6 +827,7 @@ tests/unit/test_distill_merge.py
 tests/unit/test_docs_pages_linked.py
 tests/unit/test_docsite_chrome.py
 tests/unit/test_doctor_output_polish.py
+tests/unit/test_drift_hint.py
 tests/unit/test_ed25519.py
 tests/unit/test_embed.py
 tests/unit/test_embed_local.py
@@ -860,6 +862,7 @@ tests/unit/test_install_permission_error.py
 tests/unit/test_installscan.py
 tests/unit/test_integrity.py
 tests/unit/test_journal.py
+tests/unit/test_jsonstate.py
 tests/unit/test_langchain_packaging.py
 tests/unit/test_link_ownership.py
 tests/unit/test_localembed.py

{boost_skill_cli-1.2.89 → boost_skill_cli-1.2.90}/docs/DEBUGGING.md

@@ -203,6 +203,42 @@ plain `upgrade` has already been tried and refused.
 
 ---
 
+## A corrupt config/settings/state file
+
+boost keeps several small JSON files — `~/.boost/config.json`, each agent's
+`settings.json` (hooks), `~/.boost/state/context.json`/`focus.json`, and a
+saved `boost profile`. If one of these exists but fails to parse (a truncated
+write, a hand-edited trailing comma), the read that notices prints a warning
+to stderr naming the file and the JSON error, then falls back to that file's
+empty/default state for the current command — the bad bytes are left on disk,
+untouched, by the read itself.
+
+**The next write to that file is what matters.** Rather than silently
+building a fresh file from the empty/default view and overwriting the corrupt
+one — losing whatever was in it, with no way back — boost moves the corrupt
+file aside first:
+
+- `~/.claude/settings.json` (and `~/.gemini/settings.json`) already snapshot
+  the *previous* version into `~/.boost/state/claude-settings-history/` on
+  every write, corrupt or not, so a corrupt file is preserved there too.
+  `boost hooks add` prints that snapshot's path (`backup: ...`) whenever one
+  is written, so you don't have to know the history directory exists to use
+  it.
+- `~/.boost/config.json` and the `context.json`/`focus.json` state files have
+  no such standing history, so the write itself quarantines a corrupt file to
+  `<name>.json.corrupt` (or `.corrupt.2`, `.corrupt.3`, ... if that name is
+  already taken by an earlier corruption) before writing the new one, and
+  says so on stderr.
+- `boost profile list` marks a corrupt profile `(unreadable)` instead of
+  hiding it, and `boost profile delete <name>` only checks that the file
+  exists — not that it parses — so a corrupt profile can still be deleted.
+
+None of this recovers a corrupt file's *content* automatically — it recovers
+the bytes so you can look at them (`<name>.json.corrupt`, or the newest file
+under `claude-settings-history/`) and hand-merge anything worth keeping.
+
+---
+
 ## Environment variables
 
 Everything that changes boost's runtime behaviour, in one place:

{boost_skill_cli-1.2.89 → boost_skill_cli-1.2.90}/docs/roadmap/items/audit-corrupt-settings-config-state-json-silently-read-as-empty-th.md

@@ -2,15 +2,15 @@
 id: audit-corrupt-settings-config-state-json-silently-read-as-empty-th
 board: code
 section: dx
-status: planned
+status: shipped
 category: Safety · Bug
 complexity: M
 impact: High
 wow: 2
 note: a trailing comma in settings.json costs the permissions/model block on the next hooks add
 order: 203
-owner:
-pr:
+owner: loop/corrupt-json-state
+pr: 714
 title: "Corrupt settings/config/state JSON silently read as empty, then clobbered on the next write"
 ---
 One shared load pattern across four surfaces: a JSON file that exists but does not parse is read as <code>{}</code> (<code>except (JSONDecodeError, OSError)</code> at <code>boost_cli/core/claude_settings.py:74-75</code> and <code>boost_cli/core/config.py:129</code>/<code>196-203</code>/<code>246-250</code>), and the next write replaces it. Verified worst case: with a trailing comma in <code>~/.claude/settings.json</code>, <code>hooks add SessionStart &hellip;</code> prints <em>&ldquo;&#10003; added SessionStart hook&rdquo;</em> exit 0 and the file afterwards holds <em>only</em> <code>{"hooks": &hellip;}</code> &mdash; the user's <code>permissions</code> and <code>model</code> keys are gone, no warning. With a corrupt <code>~/.boost/config.json</code>, <code>config list</code> silently prints the defaults, and <code>config set ai.enabled true</code> rewrites the file to defaults-plus-that-key &mdash; a 20-tap list unrecoverable, <b>no backup</b>. <code>context status</code>/<code>context map</code> and <code>focus --status</code> do the same to <code>state/context.json</code>/<code>focus.json</code>; a corrupt profile is invisible to <code>profile list</code> yet <code>profile delete broken</code> <em>refuses</em> with exit 1, because the existence check parses the file before deleting.
@@ -20,3 +20,7 @@ Verification narrowed the hooks half: <code>claude_settings.save</code> already
 Fix centrally, per the verified recommendation: when a JSON state file exists but fails to parse, warn on read naming the file and the JSON error, and before any save either refuse with a BoostError and a fix-it hint or move the bad file to <code>&lt;name&gt;.corrupt</code> and say so. <code>hooks add</code> should print the claude-settings-history snapshot path it already writes; <code>profile delete</code> should check <code>_profile_path(name).exists()</code> instead of parsing; <code>profile list</code> should show an <em>(unreadable)</em> marker. Docs: note the corrupt-file behaviour in <code>docs/DEBUGGING.md</code> (config/logging section).
 
 Found by the 2026-08 CLI audit (cluster <code>corrupt-json-clobbered</code>); repro in the audit log. Verified 2026-08-31: all four surfaces reproduced.
+
+<b>2026-09-02, PR open.</b> New <code>core/jsonstate.py</code> (<code>read_object</code>/<code>is_corrupt</code>/<code>quarantine</code>) centralizes the read-vs-corrupt distinction; <code>config.py</code>, <code>claude_settings.py</code> and <code>commands/intelligence.py</code>'s <code>_load_state</code>/<code>_save_state</code> (context/focus) all warn on a corrupt read and quarantine to <code>&lt;name&gt;.corrupt</code> (or reuse the existing history snapshot, for hooks) before the next write. <code>hooks add</code> prints the snapshot path; <code>profile delete</code> checks existence instead of parsing; <code>profile list</code> marks a corrupt profile <em>(unreadable)</em>. <code>docs/DEBUGGING.md</code> has a new section. All four surfaces from the audit are covered. Held <code>inflight</code> at PR-open time because this session's sandbox has no PyPI egress, so the mutation/lint toolchain (mutmut, vulture, xenon, interrogate, refurb, codespell, actionlint, zizmor) could not be installed to run <code>make check</code> locally &mdash; ruff, mypy, pyright and pytest (unit+functional, no coverage) were run directly against the changed files and passed clean.
+
+<b>Shipped.</b> PR #714's branch was briefly behind <code>main</code> (a train of 8 other PRs landed while CI ran); merged <code>main</code> in, re-verified locally, and CI ran clean end to end on the merged head: <code>lint</code>, <code>check</code>, the full OS&times;Python test matrix, <code>evals</code>, all six <code>mutation-shard</code> jobs plus the <code>mutation</code> gate, <code>smoke</code>/<code>install-smoke</code>, <code>dco</code>, <code>vale</code>, <code>lighthouse</code>, CodeQL and the security scanners &mdash; 41/41 checks green, no merge conflict.

{boost_skill_cli-1.2.89 → boost_skill_cli-1.2.90}/docs/roadmap/items/audit-drift-findings.md

@@ -2,15 +2,15 @@
 id: audit-drift-findings
 board: code
 section: health
-status: planned
+status: inflight
 category: CLI · Bug
 complexity: S
 impact: Med
 wow: 1
-note: source-missing hint is `boost update` — a guaranteed no-op once the tap is untapped
+note: fix up in #719, awaiting CI + review — sandbox couldn't run the full mutation/eval/smoke gate locally (no PyPI egress)
 order: 264
-owner:
-pr:
+owner: loop/drift-source-missing-hint
+pr: 719
 title: "boost drift: CLI audit findings (2026-08)"
 ---
 <b>drift hints <code>boost update</code> for source-missing items whose tap was untapped — a

{boost_skill_cli-1.2.89 → boost_skill_cli-1.2.90}/docs/roadmap.html

@@ -6666,7 +6666,7 @@ excerpts at <code>:159-164</code>) to match. Found by the 2026-08 CLI audit (clu
       </article>
 
       <article class="cap rcard" id="audit-drift-findings">
-        <div class="head"><span class="pill planned">Planned</span><span class="cat">CLI · Bug</span></div>
+        <div class="head"><span class="pill inflight">In flight</span><span class="cat">CLI · Bug</span></div>
         <h3>boost drift: CLI audit findings (2026-08)</h3>
         <p><b>drift hints <code>boost update</code> for source-missing items whose tap was untapped — a
 guaranteed no-op.</b> After <code>untap Aaronontheweb/dotnet-cursor-rules</code>, drift reports
@@ -6690,7 +6690,7 @@ entry's tap into <code>_drift_hint</code> (<code>quality.py:255-258</code>) and
           <span class="m">Complexity <b>S</b></span>
           <span class="m">Impact <b>Med</b></span>
           <span class="m">Wow <b class="wow">★</b></span>
-          <span class="m">source-missing hint is `boost update` — a guaranteed no-op once the tap is untapped</span>
+          <span class="m">fix up in</span>
         </div>
       </article>
 
@@ -11635,15 +11635,20 @@ Found by the 2026-08 CLI audit (cluster <code>config-policy-set-validation</code
       </article>
 
       <article class="cap rcard" id="audit-corrupt-settings-config-state-json-silently-read-as-empty-th">
-        <div class="head"><span class="pill planned">Planned</span><span class="cat">Safety · Bug</span></div>
+        <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Safety · Bug</span></div>
         <h3>Corrupt settings/config/state JSON silently read as empty, then clobbered on the next write</h3>
+        <details class="cardbody"><summary>Write-up</summary>
         <p>One shared load pattern across four surfaces: a JSON file that exists but does not parse is read as <code>{}</code> (<code>except (JSONDecodeError, OSError)</code> at <code>boost_cli/core/claude_settings.py:74-75</code> and <code>boost_cli/core/config.py:129</code>/<code>196-203</code>/<code>246-250</code>), and the next write replaces it. Verified worst case: with a trailing comma in <code>~/.claude/settings.json</code>, <code>hooks add SessionStart &hellip;</code> prints <em>&ldquo;&#10003; added SessionStart hook&rdquo;</em> exit 0 and the file afterwards holds <em>only</em> <code>{"hooks": &hellip;}</code> &mdash; the user's <code>permissions</code> and <code>model</code> keys are gone, no warning. With a corrupt <code>~/.boost/config.json</code>, <code>config list</code> silently prints the defaults, and <code>config set ai.enabled true</code> rewrites the file to defaults-plus-that-key &mdash; a 20-tap list unrecoverable, <b>no backup</b>. <code>context status</code>/<code>context map</code> and <code>focus --status</code> do the same to <code>state/context.json</code>/<code>focus.json</code>; a corrupt profile is invisible to <code>profile list</code> yet <code>profile delete broken</code> <em>refuses</em> with exit 1, because the existence check parses the file before deleting.
 
 Verification narrowed the hooks half: <code>claude_settings.save</code> already snapshots the prior file into <code>~/.boost/state/claude-settings-history/</code> before every write (confirmed byte-for-byte), so that path is recoverable &mdash; but silently, and nothing tells the user. <code>config.json</code> has no such net: that loss is real. Degrading a corrupt file to defaults on <em>read</em> is arguably deliberate (the <code>config.py</code> comment says so); silently <em>overwriting</em> it on the next write is documented nowhere and destroys user data. The roadmap's atomic-lock-file-writes item covers the lock file only &mdash; related pattern, not a duplicate.
 
 Fix centrally, per the verified recommendation: when a JSON state file exists but fails to parse, warn on read naming the file and the JSON error, and before any save either refuse with a BoostError and a fix-it hint or move the bad file to <code>&lt;name&gt;.corrupt</code> and say so. <code>hooks add</code> should print the claude-settings-history snapshot path it already writes; <code>profile delete</code> should check <code>_profile_path(name).exists()</code> instead of parsing; <code>profile list</code> should show an <em>(unreadable)</em> marker. Docs: note the corrupt-file behaviour in <code>docs/DEBUGGING.md</code> (config/logging section).
 
-Found by the 2026-08 CLI audit (cluster <code>corrupt-json-clobbered</code>); repro in the audit log. Verified 2026-08-31: all four surfaces reproduced.</p>
+Found by the 2026-08 CLI audit (cluster <code>corrupt-json-clobbered</code>); repro in the audit log. Verified 2026-08-31: all four surfaces reproduced.
+
+<b>2026-09-02, PR open.</b> New <code>core/jsonstate.py</code> (<code>read_object</code>/<code>is_corrupt</code>/<code>quarantine</code>) centralizes the read-vs-corrupt distinction; <code>config.py</code>, <code>claude_settings.py</code> and <code>commands/intelligence.py</code>'s <code>_load_state</code>/<code>_save_state</code> (context/focus) all warn on a corrupt read and quarantine to <code>&lt;name&gt;.corrupt</code> (or reuse the existing history snapshot, for hooks) before the next write. <code>hooks add</code> prints the snapshot path; <code>profile delete</code> checks existence instead of parsing; <code>profile list</code> marks a corrupt profile <em>(unreadable)</em>. <code>docs/DEBUGGING.md</code> has a new section. All four surfaces from the audit are covered. Held <code>inflight</code> at PR-open time because this session's sandbox has no PyPI egress, so the mutation/lint toolchain (mutmut, vulture, xenon, interrogate, refurb, codespell, actionlint, zizmor) could not be installed to run <code>make check</code> locally &mdash; ruff, mypy, pyright and pytest (unit+functional, no coverage) were run directly against the changed files and passed clean.
+
+<b>Shipped.</b> PR #714's branch was briefly behind <code>main</code> (a train of 8 other PRs landed while CI ran); merged <code>main</code> in, re-verified locally, and CI ran clean end to end on the merged head: <code>lint</code>, <code>check</code>, the full OS&times;Python test matrix, <code>evals</code>, all six <code>mutation-shard</code> jobs plus the <code>mutation</code> gate, <code>smoke</code>/<code>install-smoke</code>, <code>dco</code>, <code>vale</code>, <code>lighthouse</code>, CodeQL and the security scanners &mdash; 41/41 checks green, no merge conflict.</p></details>
         <div class="meta">
           <span class="m">Complexity <b>M</b></span>
           <span class="m hi">Impact <b>High</b></span>