boost-skill-cli 1.2.96__tar.gz → 1.2.98__tar.gz

{boost_skill_cli-1.2.96 → boost_skill_cli-1.2.98}/.vale/styles/config/vocabularies/boost/accept.txt

@@ -37,6 +37,8 @@ CRM
 cron
 crontab
 cyclomatic
+dedupe
+deduped
 Dependabot
 deps
 deserialization

{boost_skill_cli-1.2.96/boost_skill_cli.egg-info → boost_skill_cli-1.2.98}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.2.96
+Version: 1.2.98
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License-Expression: Apache-2.0
@@ -421,6 +421,13 @@ at least 95% alike, fold into one badged `×5`, with `^D` to show them again.
 Identity is the description and never the name: `code-reviewer` appears 75 times
 with 42 different descriptions, and those are 42 real skills.
 
+Without a real TTY (a pipe, an IDE run console, a terminal curses can't drive)
+`browse` falls back to a plain, deduped table — name, version, tap, kind — with
+a footer breaking the total down by kind and pointing at `boost search` to
+narrow it. The same fallback covers a curses initialization failure, so a
+terminal that merely *claims* `isatty()` degrades gracefully instead of
+crashing mid-draw.
+
 ## 81 commands, organized into 8 groups
 
 `boost --help` prints the full grouped list. For every flag of every command see

{boost_skill_cli-1.2.96 → boost_skill_cli-1.2.98}/README.md

@@ -379,6 +379,13 @@ at least 95% alike, fold into one badged `×5`, with `^D` to show them again.
 Identity is the description and never the name: `code-reviewer` appears 75 times
 with 42 different descriptions, and those are 42 real skills.
 
+Without a real TTY (a pipe, an IDE run console, a terminal curses can't drive)
+`browse` falls back to a plain, deduped table — name, version, tap, kind — with
+a footer breaking the total down by kind and pointing at `boost search` to
+narrow it. The same fallback covers a curses initialization failure, so a
+terminal that merely *claims* `isatty()` degrades gracefully instead of
+crashing mid-draw.
+
 ## 81 commands, organized into 8 groups
 
 `boost --help` prints the full grouped list. For every flag of every command see

{boost_skill_cli-1.2.96 → boost_skill_cli-1.2.98}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.2.96'
-__version_tuple__ = version_tuple = (1, 2, 96)
+__version__ = version = '1.2.98'
+__version_tuple__ = version_tuple = (1, 2, 98)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.2.96 → boost_skill_cli-1.2.98}/boost_cli/commands/configuration.py

@@ -401,7 +401,7 @@ def cmd_create(argv) -> int:
                    help="install the new skill immediately")
     args = p.parse_args(argv)
 
-    name = util.slugify(args.name)
+    name = util.resolve_slug(args.name)
     parent = paths.expand(args.dir) if args.dir else Path.cwd()
     target = parent / name
     skill_md = target / "SKILL.md"
@@ -529,7 +529,9 @@ def cmd_policy(argv) -> int:
     everything = lockfile.all_installed()
     min_score = int(pol.get("min_quality_score") or 0)
     violations = []  # (name, problem)
+    not_checked: set[str] = set()
     total = 0
+    skill_count = len(everything.get("skill", {}))
     for kind, section in everything.items():
         for name, entry in sorted(section.items()):
             total += 1
@@ -541,12 +543,36 @@ def cmd_policy(argv) -> int:
                 violations.append((label, "tap %s is blocked" % tap))
             if pol["allowed_taps"] and tap not in pol["allowed_taps"] and tap != "local":
                 violations.append((label, "tap %s is not on the allowlist" % tap))
+            violations.extend(
+                (label, msg) for msg in policy.check_installed_version(entry))
+            # require_description and denied_capabilities need the item's
+            # own content, which only a skill has on disk (see
+            # store.read_skill_meta) — a rule or workflow lands in a shared
+            # agent file with no per-item body to check.
+            if kind == "skill" and (pol["require_description"] or pol["denied_capabilities"]):
+                meta_body = store.read_skill_meta(name)
+                if meta_body is None:
+                    not_checked.add(
+                        "require_description/denied_capabilities "
+                        "(store copy unreadable)")
+                else:
+                    meta, body = meta_body
+                    violations.extend(
+                        (label, msg)
+                        for msg in policy.check_installed_meta(meta, body))
+            elif kind != "skill" and (pol["require_description"] or pol["denied_capabilities"]):
+                not_checked.add(
+                    "require_description/denied_capabilities for %s items "
+                    "(no on-disk body to check)" % kind)
             # Quality scoring reads a store directory, which only skills have.
             if min_score and kind == "skill":
                 score, _notes = util.score_skill(store.skill_store_dir(name))
                 if score < min_score:
                     violations.append(
                         (label, "quality score %d < required %d" % (score, min_score)))
+    max_skills_msg = policy.max_skills_violation(skill_count)
+    if max_skills_msg:
+        violations.append(("(environment)", max_skills_msg))
     unpinned = sorted(
         n if k == "skill" else "%s (%s)" % (n, k)
         for k, section in everything.items()
@@ -560,6 +586,8 @@ def cmd_policy(argv) -> int:
                else ", ".join("%d %s%s" % (n, kind, _s(n))
                               for kind, n in counts.items()))
 
+    enforce = config.get("policy_enforce", True)
+
     if args.json:
         print(json.dumps({
             # "skills" keeps its original meaning — the skill count — with the
@@ -570,14 +598,23 @@ def cmd_policy(argv) -> int:
             "violations": [{"skill": s, "violation": v} for s, v in violations],
             "pin_only": bool(pol["pin_only"]),
             "unpinned": unpinned if pol["pin_only"] else [],
+            "enforce": enforce,
+            "not_checked": sorted(not_checked),
         }, indent=2))
         return 1 if violations else 0
 
     _warn_invalid_policy_values()
+    if not enforce:
+        out.warn("policy_enforce is off — `boost install` does not enforce "
+                 "any of the rules below; this report names what would be "
+                 "flagged, not what is currently blocked")
     if pol["pin_only"]:
-        out.info("pin-only mode is on — installs/updates are frozen"
+        out.info("pin-only mode is on — new installs and skill updates are "
+                 "frozen (tap refreshes via `boost update` are unaffected)"
                  + (" (%d unpinned item(s): %s)"
                     % (len(unpinned), ", ".join(unpinned)) if unpinned else ""))
+    for note in sorted(not_checked):
+        out.dim("  not checked: %s" % note)
     if violations:
         out.table(violations, headers=("ITEM", "VIOLATION"))
         print()
@@ -823,6 +860,17 @@ def cmd_completions(argv) -> int:
 
     detected = args.shell or Path(os.environ.get("SHELL", "")).name
 
+    # Fixed once, here, rather than in each branch below: an empty $SHELL
+    # used to fall through silently to the bash script (print path) or to
+    # `_rc_path("")`'s confusing "no one-shot install for  yet" (install
+    # path) — neither ever told the user *why*. Raising here means every
+    # path downstream — print, --install, --uninstall, --dry-run — sees the
+    # same clear error instead of reinventing it.
+    if not detected:
+        raise BoostError(
+            "cannot detect your shell ($SHELL unset)",
+            hint="pass bash, zsh or fish, e.g. `boost completions bash`")
+
     if args.dry_run and not (args.install or args.uninstall):
         p.error("--dry-run qualifies --install or --uninstall; "
                 "pass one of them")
@@ -851,6 +899,15 @@ def cmd_completions(argv) -> int:
         return 0
 
     shell = detected if detected in ("bash", "zsh", "fish") else "bash"
+    if shell != detected:
+        # A real shell boost has no script for (e.g. nu, xonsh) — silently
+        # substituting bash used to look like success while handing the user
+        # a script their shell cannot source. stderr, not stdout: stdout here
+        # is the completion script itself (piped to a file or `eval`'d), and
+        # a warning line mixed into it would corrupt both uses.
+        out.warn("%s is not a supported shell (bash, zsh, fish) — showing "
+                 "bash's completion script instead" % detected,
+                 stream=sys.stderr)
     # The script is a thin shim that calls `boost __complete`; the candidate
     # rules live in core/complete.py so all three shells share one tested
     # implementation instead of three hand-maintained static lists.
@@ -940,6 +997,21 @@ def _interval_label(seconds) -> str:
     return "%ss" % seconds
 
 
+def _plist_interval_seconds(text: str) -> int | None:
+    """Parse a usable ``StartInterval`` out of plist ``text``.
+
+    None for both "no ``StartInterval`` key" and "``StartInterval`` present
+    but not positive" — a zero or negative interval can never fire, and
+    treating it as usable is what let the next-run loop in ``cmd_schedule``
+    spin forever advancing ``nxt`` by zero seconds each pass.
+    """
+    m = re.search(r"<key>StartInterval</key>\s*<integer>(-?\d+)</integer>", text)
+    if not m:
+        return None
+    secs = int(m.group(1))
+    return secs if secs > 0 else None
+
+
 def cmd_schedule(argv) -> int:
     """boost schedule [status|enable [--interval 6h|12h|daily]|disable]"""
     p = cliparse.parser(
@@ -965,10 +1037,8 @@ def cmd_schedule(argv) -> int:
             plist = _plist_path()
             if plist.exists():
                 present = True
-                m = re.search(r"<key>StartInterval</key>\s*<integer>(\d+)</integer>",
-                              plist.read_text(encoding="utf-8"))
-                if m:
-                    secs = int(m.group(1))
+                secs = _plist_interval_seconds(plist.read_text(encoding="utf-8"))
+                if secs is not None:
                     interval = _interval_label(secs)
                     nxt = datetime.fromtimestamp(plist.stat().st_mtime + secs)
                     while nxt < datetime.now():
@@ -995,7 +1065,8 @@ def cmd_schedule(argv) -> int:
         out.kv("platform", "%s (%s)" % (sys.platform, "launchd" if darwin else "cron"))
         out.kv("scheduled", "yes" if present else "no")
         if present:
-            out.kv("interval", "every %s" % interval)
+            out.kv("interval", "every %s" % interval if interval is not None
+                   else "unknown (plist has no usable StartInterval)")
             out.kv("next run", next_run.strftime("%Y-%m-%d %H:%M (approx)")
                    if next_run else "unknown")
         else:

{boost_skill_cli-1.2.96 → boost_skill_cli-1.2.98}/boost_cli/commands/discovery.py

@@ -37,6 +37,7 @@ from ..core import (
     store,
     util,
 )
+from ..core import discovery as discovery_core
 from ..core import output as out
 from ..core.stackprobe import detect_stack  # re-exported: shared with Quality
 from ..errors import BoostError
@@ -64,6 +65,17 @@ def _discovery_path() -> Path:
     return paths.cache_dir() / "discovery.json"
 
 
+def _index_item_count(path: Path) -> int:
+    """Item count of an existing discovery.json, or 0 if absent/unreadable."""
+    if not path.exists():
+        return 0
+    try:
+        data = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError):
+        return 0
+    return len(data.get("items") or [])
+
+
 def _ai_rank(query: str, scored):
     """Ask Claude to reorder the top hits. Returns a new scored list or None."""
     top = scored[:15]
@@ -172,14 +184,18 @@ def cmd_search(argv):
     # is pinned in tests/eval/baseline.json. Map instead of moving either.
     ranker = _ENGINE_LABEL.get(engine, engine) if use_rag else "heuristic relevance"
     if args.smart:
+        reranked = None
         if ai.available():
             with spin.Spinner("ranking %d matches with Claude" % len(scored)):
                 reranked = _ai_rank(query, scored)
-            if reranked:
-                scored, ranker = reranked, "Claude Haiku relevance"
+        if reranked:
+            scored, ranker = reranked, "Claude Haiku relevance"
         else:
-            # On stderr and unconditional on --json: a script reading stdout
-            # as JSON must still learn --smart silently did nothing.
+            # Fires whether AI was never available or was tried and failed —
+            # a silent unranked list otherwise looks identical to a
+            # deliberate BM25-only result. On stderr and unconditional on
+            # --json: a script reading stdout as JSON must still learn that
+            # --smart silently did nothing.
             out.warn(ai.fallback_note(), wrap=True, stream=sys.stderr)
     if args.as_json:
         print(json.dumps([e | {"score": s, "ranker": ranker}
@@ -648,19 +664,21 @@ def cmd_index(argv):
                  % (urllib.parse.quote(q, safe=":"), page)],
                 capture_output=True, text=True, timeout=120)
         except (subprocess.TimeoutExpired, OSError) as e:
+            spin.progress_clear()
             raise BoostError("gh api timed out on page %d" % page, hint=str(e)) from e
         if proc.returncode != 0:
-            tail = "\n".join((proc.stderr or proc.stdout or "").strip()
-                             .splitlines()[-3:])
+            spin.progress_clear()
             if not items:
                 raise BoostError("GitHub code search failed",
-                                hint=tail or "check `gh auth status`")
+                                hint=discovery_core.gh_failure_hint(
+                                    proc.stderr or proc.stdout or ""))
             out.warn("page %d failed — keeping the %d items fetched so far"
                      % (page, len(items)))
             break
         try:
             data = json.loads(proc.stdout)
         except json.JSONDecodeError:
+            spin.progress_clear()
             raise BoostError("gh api returned unparseable JSON",
                             hint="try `boost index` again, or `gh auth status`") from None
         if page == 1:
@@ -678,8 +696,14 @@ def cmd_index(argv):
                 break
         if len(items) >= args.limit or len(batch) < 100:
             break
+    dpath = _discovery_path()
+    if not discovery_core.should_write_index(len(items), dpath.exists()):
+        prev = _index_item_count(dpath)
+        out.warn("no SKILL.md files match %s — keeping the previous index "
+                 "of %d entries" % (query or "your query", prev))
+        return 0
     paths.ensure_dirs()
-    _discovery_path().write_text(json.dumps(
+    dpath.write_text(json.dumps(
         {"generated": util.now_iso(), "github_total": total, "query": query,
          "items": items}, indent=1), encoding="utf-8")
     repos = len({it["repo"] for it in items})
@@ -994,11 +1018,23 @@ def cmd_recommend(argv):
 
 def _browse_plain(entries, why: str):
     out.warn(why + " — showing the full catalog")
-    out.table([(e["name"], "v" + e["version"], e["tap"],
-                "★" if e.get("curated") else "") for e in entries],
-              headers=("name", "version", "tap", ""))
-    out.info(out.role("%d skills · install with `boost install <name>`"
-                   % len(entries), "muted"))
+    # Same collapse the TUI does: a registry renders one skill into
+    # .claude/, .cursor/, .gemini/ and a plugin root, and this fallback used
+    # to list every copy with nothing to tell them apart.
+    unique = [e for e, _n in browse.dedupe(entries)]
+    show_curated = any(e.get("curated") for e in unique)
+    headers = ["name", "version", "tap", "kind"]
+    rows = [[e["name"], "v" + e["version"], e["tap"],
+             out.kind_label(e.get("kind", "skill"))]
+            for e in unique]
+    if show_curated:
+        headers.append("")
+        for row, e in zip(rows, unique, strict=True):
+            row.append("★" if e.get("curated") else "")
+    out.table([tuple(row) for row in rows], headers=tuple(headers))
+    out.info(out.role(
+        "%s · install with `boost install <name>` · narrow with `boost search <query>`"
+        % browse.plain_footer(unique), "muted"))
     return 0
 
 
@@ -1747,7 +1783,17 @@ def cmd_browse(argv):
         import curses
     except ImportError:
         return _browse_plain(entries, "curses is unavailable on this Python")
-    picked = _browse_tui(curses, entries)
+    try:
+        picked = _browse_tui(curses, entries)
+    except curses.error as e:
+        # An fd that claims isatty() but isn't a real pty (IDE run consoles,
+        # `script`, TERM=dumb) can fail deep inside curses.wrapper's own
+        # setup/teardown rather than at the isatty() check above. wrapper
+        # already ran its finally block (endwin() included), so the screen is
+        # restored by the time this is caught — printing here lands on a
+        # normal terminal, not a hosed one.
+        return _browse_plain(entries,
+                             "the terminal does not support curses (%s)" % e)
     if not picked:
         return 0
     # The browser installs in place now, so anything it hands back is usually

{boost_skill_cli-1.2.96 → boost_skill_cli-1.2.98}/boost_cli/commands/info.py

@@ -703,8 +703,18 @@ def cmd_preview(argv):
     args = ap.parse_args(argv)
     text, _kind, lock, cat = _resolve_text(args.name)
     meta, body = frontmatter.parse(text)
+    if not sys.stdout.isatty():
+        # A piped/redirected preview renders nothing — no ANSI, so the
+        # per-chunk `_inline()` substitution would strip `**`/backtick
+        # markers with no styled substitute, and lines with no special-cased
+        # handling (a bare `---`, a wrapped `> quote` continuation) print
+        # mangled rather than as either faithful Markdown or a real render.
+        # `boost cat` already resolves this the same way: raw text through.
+        sys.stdout.write(body if body.endswith("\n") else body + "\n")
+        return 0
+    version = meta.get("version") or (lock or cat or {}).get("version") or "?"
     print(out.titlebar("%s · v%s · %s" % (meta.get("name") or args.name,
-                                          meta.get("version") or "?",
+                                          version,
                                           (lock or cat or {}).get("tap", "local"))))
     print()
     _render_markdown(body)
@@ -757,6 +767,11 @@ def cmd_explain(argv):
                      "extractive summary instead"
                      % ", ".join(faithfulness.ungrounded_terms(reply, text)[:4]),
                      stream=sys.stderr)
+        else:
+            # The backend was available but the call itself produced nothing —
+            # distinct from "no backend at all", so it gets the same
+            # attributed note rather than silence.
+            out.warn(ai.fallback_note(), wrap=True, stream=sys.stderr)
     else:
         out.warn(ai.fallback_note(), wrap=True, stream=sys.stderr)
     meta, body = frontmatter.parse(text)

{boost_skill_cli-1.2.96 → boost_skill_cli-1.2.98}/boost_cli/commands/intelligence.py

@@ -14,6 +14,7 @@ import difflib
 import fnmatch
 import json
 import re
+import shlex
 import sys
 import tempfile
 import textwrap
@@ -213,7 +214,8 @@ def cmd_distill(argv: list[str]) -> int:
         meta, body = frontmatter.parse(text)
         sources.append({"name": name, "origin": origin, "text": text,
                         "meta": meta, "body": body})
-    new = args.output or (names[0] + "-distilled")
+    new = util.resolve_slug(args.output, what="output name") if args.output \
+        else names[0] + "-distilled"
 
     out.heading("distilling %s → %s" % (", ".join(names), new))
     merged = _distill_ai(new, sources) if ai.available() else None
@@ -227,7 +229,9 @@ def cmd_distill(argv: list[str]) -> int:
         dest = Path.cwd() / new / "SKILL.md"
         if not _write_generated(dest, merged, yes=args.yes):
             return 1
-        out.info(out.role("install it with `boost import ./%s`" % new, "muted"))
+        out.info(out.role(
+            "install it with `boost import %s`" % shlex.quote("./" + new),
+            "muted"))
     journal.log("distill", new, sources=names)
     return 0
 
@@ -1188,6 +1192,8 @@ def cmd_impact(argv: list[str]) -> int:
             if reply:
                 print()
                 print(textwrap.indent(textwrap.fill(reply, width=76), "  "))
+            else:
+                _note_fallback()
         else:
             _note_fallback()
     out.dim("  " + note)
@@ -1252,6 +1258,11 @@ def _print_reply(reply: chat_engine.Reply, show_sources: bool) -> None:
         # a downgraded answer that looks identical to a confident one.
         out.warn("the AI reply named something outside the retrieved skills — "
                  "showing the grounded matches instead")
+    elif reply.ai_failed:
+        # AI was available and was tried, but the call itself produced
+        # nothing — distinct from never having a backend, and otherwise
+        # indistinguishable from a deliberate extractive answer.
+        out.warn(ai.fallback_note(), wrap=True, stream=sys.stderr)
 
 
 def cmd_chat(argv: list[str]) -> int:

{boost_skill_cli-1.2.96 → boost_skill_cli-1.2.98}/boost_cli/commands/pkg.py

@@ -21,6 +21,7 @@ from .. import cliparse, spin
 from ..core import (
     adapters,
     agents,
+    archive,
     catalog,
     complete,
     config,
@@ -1072,9 +1073,12 @@ def cmd_update(argv: list[str]) -> int:
         out.info("no taps configured — start with `boost tap --defaults`")
         return 0
     moved = []
+    pinned_skips = 0
     for tname, summary in results.items():
         if "skipped" not in summary:
             catalog.rebuild_tap(registry.get(tname))
+        else:
+            pinned_skips += 1
         # "abc1234 → def5678" is a tap whose tree changed; "already up to date"
         # and "pinned at ..." are not. Only the first invalidates vectors.
         if "→" in summary:
@@ -1090,6 +1094,14 @@ def cmd_update(argv: list[str]) -> int:
             "%d of %d taps could not be refreshed — the rest are up to date. "
             "Drop a dead one with `boost untap <name>`."
             % (len(failures), len(results) + len(failures)), "muted"))
+    if pinned_skips:
+        out.info(out.role(
+            "%d tap%s pinned and left alone — `boost update --force` moves "
+            "%s too, dropping %s pin%s"
+            % (pinned_skips, "s" if pinned_skips != 1 else "",
+               "them" if pinned_skips != 1 else "it",
+               "their" if pinned_skips != 1 else "its",
+               "s" if pinned_skips != 1 else ""), "muted"))
     # A pulled tap can add, drop, or rename catalogue entries, so the
     # completion name cache must not survive an update unrefreshed.
     complete.refresh_names()
@@ -1144,10 +1156,18 @@ def cmd_update(argv: list[str]) -> int:
     upgraded += _update_materialized("rule", lockfile.installed_rules(), results)
     upgraded += _update_materialized("workflow", lockfile.installed_workflows(), results)
     if not upgraded:
-        # Don't claim "everything up to date" when some taps were never
-        # reached — that is exactly the false all-clear this fix exists to stop.
-        out.ok("everything up to date" if not failures
-               else "everything up to date, except the taps above")
+        if pinned_skips and pinned_skips == len(results) and not failures:
+            # Every tap was a pinned skip: nothing was actually checked over
+            # the network, which "everything up to date" would misreport as
+            # a fresh confirmation rather than the truth — the run never left
+            # config.json.
+            out.ok("nothing to refresh — all taps pinned")
+        else:
+            # Don't claim "everything up to date" when some taps were never
+            # reached — that is exactly the false all-clear this fix exists
+            # to stop.
+            out.ok("everything up to date" if not failures
+                   else "everything up to date, except the taps above")
     # Non-zero only when nothing was refreshed at all. A partial run did the job
     # it could do, and failing it would put us back to one dead upstream
     # breaking `boost update` for the other 79.
@@ -1769,11 +1789,17 @@ def cmd_export(argv: list[str]) -> int:
                                  "agent config files; reinstall them "
                                  "from their tap")
         if not store.skill_store_dir(name).is_dir():
-            raise BoostError("store dir for %s is missing" % name,
-                            hint="repair with `boost sync`")
+            raise BoostError(
+                "store dir for %s is missing" % name,
+                hint=("repair with `boost reinstall %s`" % name)
+                     if entry.get("tap") == "local"
+                     else "repair with `boost sync`")
         chosen[name] = entry
     stamp = datetime.now(UTC).strftime("%Y%m%d")
-    ext = ".zip" if args.zip else ".tar.gz"
+    use_zip, format_warning = archive.resolve_export_format(args.out, args.zip)
+    if format_warning:
+        out.warn(format_warning)
+    ext = ".zip" if use_zip else ".tar.gz"
     dest = paths.expand(args.out) if args.out else Path(
         "boost-skills-%s%s" % (stamp, ext))
     if dest.exists() and not args.force:
@@ -1782,9 +1808,10 @@ def cmd_export(argv: list[str]) -> int:
                              "different -o path")
     manifest = _boostfile_text(chosen, via="boost export")
     try:
-        if args.zip:
+        if use_zip:
             with zipfile.ZipFile(str(dest), "w", zipfile.ZIP_DEFLATED) as zf:
-                zf.writestr("Boostfile", manifest)
+                zf.writestr(archive.boostfile_zipinfo(
+                    datetime.now(UTC).timetuple()[:6]), manifest)
                 for name in chosen:
                     sdir = store.skill_store_dir(name)
                     for f in sorted(p for p in sdir.rglob("*") if p.is_file()):
@@ -1796,9 +1823,10 @@ def cmd_export(argv: list[str]) -> int:
                 ti.size = len(data)
                 ti.mtime = int(datetime.now(UTC).timestamp())
                 ti.mode = 0o644
-                tf.addfile(ti, io.BytesIO(data))
+                tf.addfile(archive.normalize_tar_member(ti), io.BytesIO(data))
                 for name in chosen:
-                    tf.add(str(store.skill_store_dir(name)), arcname=name)
+                    tf.add(str(store.skill_store_dir(name)), arcname=name,
+                          filter=archive.normalize_tar_member)
     except OSError as e:
         raise BoostError("cannot write %s: %s" % (_tilde(dest), e.strerror or e),
                         hint="check the output path exists and is writable") from e

{boost_skill_cli-1.2.96 → boost_skill_cli-1.2.98}/boost_cli/commands/quality.py

@@ -1233,6 +1233,12 @@ def cmd_conflict(argv):
             for i, p in enumerate(heuristic, 1):
                 if i in confirmed:
                     p["kind"] = "ai-confirmed"
+        elif not args.json:
+            # The backend was available but the call itself produced nothing —
+            # distinct from "no backend at all", so it gets the same
+            # attributed note rather than leaving the pairs silently
+            # unconfirmed.
+            out.warn(ai.fallback_note(), wrap=True)
     elif heuristic and not args.json:
         out.warn(ai.fallback_note(), wrap=True)
 
@@ -1294,15 +1300,27 @@ def cmd_health(argv):
         prog="boost health", description="Dashboard of skill-environment health")
     ap.parse_args(argv)
 
-    installed = _iter_installed()
-    quarantined = sum(1 for _n, e in installed if e.get("quarantined"))
-    pinned = sum(1 for _n, e in installed if e.get("pinned"))
+    # Skills-only used to be the whole dashboard, so a rule or workflow could
+    # drift — or vanish from the store entirely — invisibly: the skills line
+    # and the drift row below both only ever saw `_iter_installed()`. Walking
+    # every kind here is what lets the drift row match `boost drift` on the
+    # same lock file instead of silently under-reporting it.
+    all_installed = _iter_installed_all()
+    by_kind: dict[str, list[tuple[str, dict]]] = {}
+    for kind, name, entry in all_installed:
+        by_kind.setdefault(kind, []).append((name, entry))
+    installed = by_kind.get("skill", [])
     taps = registry.list_taps()
     cloned = [t for t in taps if t.is_cloned]
 
     out.heading("boost health")
-    out.kv("skills", "%d installed · %d quarantined · %d pinned"
-           % (len(installed), quarantined, pinned))
+    for kind, label in (("skill", "skills"), ("rule", "rules"),
+                        ("workflow", "workflows")):
+        items = by_kind.get(kind, [])
+        q = sum(1 for _n, e in items if e.get("quarantined"))
+        p = sum(1 for _n, e in items if e.get("pinned"))
+        out.kv(label, "%d installed · %d quarantined · %d pinned"
+               % (len(items), q, p))
     out.kv("taps", "%d configured · %d cloned" % (len(taps), len(cloned)))
 
     expected = [n for n, e in installed if not e.get("quarantined")]
@@ -1315,17 +1333,25 @@ def cmd_health(argv):
         out.kv(agent, "%d/%d %s" % (linked, len(expected),
                                     out.role("✓", "success") if full
                                     else out.role("!", "warn")))
-    # Agents that read the canonical store have no links to count — scoring
-    # them 0/N would report a healthy setup as broken. They are listed anyway,
-    # because an agent silently absent from a health report reads as "boost is
-    # not wired up for it".
+    # Agents that read the canonical store have no links to count, so they
+    # used to be scored an unconditional len(expected)/len(expected) — green
+    # even with a skill's store directory gone, in the same report `drift`
+    # called store-missing. Stat the store instead. They are listed even when
+    # full, because an agent silently absent from a health report reads as
+    # "boost is not wired up for it".
+    store_present = sum(1 for n in expected if store.skill_store_dir(n).is_dir())
+    store_full = store_present == len(expected)
     for agent in agents.native_store_agents():
+        coverage_ok = coverage_ok and store_full
         out.kv(agent, "%d/%d %s (reads the store directly)"
-               % (len(expected), len(expected), out.role("✓", "success")))
+               % (store_present, len(expected),
+                  out.role("✓", "success") if store_full
+                  else out.role("!", "warn")))
 
     drift_counts: dict = {}
-    for name, entry in installed:
-        st = _drift_status(name, entry)
+    for kind, name, entry in all_installed:
+        st = (_drift_status(name, entry) if kind == "skill"
+              else _drift_status_materialized(kind, name, entry))
         drift_counts[st] = drift_counts.get(st, 0) + 1
     out.kv("drift", " · ".join("%d %s" % (n, s)
                                for s, n in sorted(drift_counts.items())) or "—")