Skip to main content

dev-tools

Developer tooling for the BoomTick repository. The primary entry point is td, but agents should always call boomtick-mcp Tier 1 tools first — td is the Tier 2 fallback. See .agents/AGENTS.md for the full tool hierarchy.


🚀 One-Step Setup

./setup-agent.sh

This setup script is now located at the repository root (not symlinked) and handles system tools, Node.js, pnpm, Python dependencies, Playwright, remote origin configuration, and git hook registration.


🔑 Environment Variables

Variable Required Purpose
GITHUB_TOKEN (string) Required Auth for gh and td gh ... commands (PR audits, comments, variables, status checks). Standard for GH Actions.
GITHUB_REPOSITORY (owner/repo) Recommended Ensures deterministic origin remote auto-configuration.
JULES_API_KEY Optional Enables td agent ... / td jules ... cloud workflows.
GEMINI_API_KEY Optional Enables Gemini-backed review/audit workflows.

Secret handling guidance

  • GitHub Actions / agent runners: store GITHUB_TOKEN, JULES_API_KEY, and GEMINI_API_KEY in repository or org Secrets.
  • Dev containers / local shells: export secrets before running setup/CLI:
export GITHUB_TOKEN="<token>"
export GITHUB_REPOSITORY="owner/repo"
# optional
export JULES_API_KEY="<key>"
export GEMINI_API_KEY="<key>"

Optional tuning variables

  • SKIP_GIT_HOOKS=1 — skip git hook execution (e.g. in CI).
  • SKIP_VALIDATION=1 — skip post-setup runtime validation.
  • NODE_MAJOR — override Node major used for apt installation (defaults to 24).

🧩 Workflow-Specific Setup

After ./setup-agent.sh, use the following workflow-specific setup:

1) Standard PR / Review Workflows

  • Plan a review (fetches context and audits):
    • td agent plan-review --pr <PR_NUMBER>
  • Submit audit results (after authoring the review in pr-review-<PR>.md):
    • td gh audit-pr <PR_NUMBER> --submit --execute
  • Pre-submit quality gate before push/merge:
    • td gh pre-submit

2) Jules Workflows

  • Required secret: JULES_API_KEY.
  • Optional context env var: JULES_SOURCE_ID (if your environment already knows the source mapping).
  • Typical commands:
    • td agent dispatch <BRANCH> "<TASK>"
    • td agent fix-ci --pr-number <PR> --execute
    • td agent sync

3) Headless / Bot Auditing

  • For batch auditing open PRs:
    • td gh audit-pr <PR_NUMBER> --fetch --audit --submit --execute
  • Ensure jq, gh, Python deps, and pnpm deps are installed (handled by setup script).

🗂️ Agent Context Index

.agent-context.json (repository root) is the pre-built index that boomtick-mcp reads on every tool call. It contains file_tree, cli_schema, and package_json metadata — built by scripts/build-repo-context.py.

The index is kept fresh automatically by the git hooks registered during ./setup-agent.sh:

  • .githooks/post-checkout — refreshes on branch switch
  • .githooks/post-merge — refreshes on pull/merge

To manually refresh:

pnpm run agent:prime

If the index is stale, MCP tools fall back to raw filesystem calls, bypassing the index and increasing token usage. Always refresh before running reviews or dispatching Jules sessions.


🤖 Agent / Jules GitHub Command Pattern

Always use boomtick-mcp Tier 1 tools first. td-cli is the fallback when MCP is unavailable — not the default. See .agents/AGENTS.md for the full tool mapping table.

When td must be called directly, read the CLI schema from .agent-context.json rather than guessing flags or running --help:

# Extract schema for a specific subcommand before calling it
cat .agent-context.json | python3 -c "
import json, sys
schema = json.load(sys.stdin)
print(json.dumps(schema['cli_schema']['subcommands']['gh pr-diff'], indent=2))
"

Prefer repository CLI commands over raw gh:

# ✅ Preferred
td gh <repo-command>

# ⚠️ Only if td does not expose the operation
gh <command>

If auth fails, do not run gh auth login. Instead, set an environment secret named GITHUB_TOKEN.


✅ Verification Commands (Post-Setup)

node --version         # should match .node-version
pnpm --version         # should be 10.28.2
td doctor
pnpm run check:runtime-files
gh auth status

🆘 Troubleshooting

GitHub CLI not authenticated

gh issue create --title "<title>" --body "<details>"

If auth fails, report this exact issue (do not run interactive auth):

GitHub CLI is not authenticated. Please add an environment secret named GITHUB_TOKEN with a repo-scoped GitHub token.

.agent-context.json stale or missing

pnpm run agent:prime

Then re-read before proceeding with any agent operation.

pnpm / Node mismatch

Stop and report the mismatch. Do not attempt to change runtime versions unless explicitly instructed to update the runtime contract.


🚀 Repository CLI (td)

dev-tools/td is the Tier 2 unified entry point for local repository automation. All available subcommands and flags are defined in dev-tools/cli-schema.json (also embedded in .agent-context.json under cli_schema). That file is the single source of truth — never use --help to discover flags.

Key subcommand groups:

Group Description
doctor Runtime consistency check
gh GitHub operations (PRs, issues, audits, conflicts)
repo Repository operations (CI logs, Playwright)
agent / jules Jules agent session management

Metadata

Release files for boomtick-cli 0.12.1

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for boomtick-cli 0.12.1
File Size Uploaded Provenance
boomtick_cli-0.12.1.tar.gz 195.3 kB With provenance Details

Built distribution (wheel)

Table of built distributions (wheels) for boomtick-cli 0.12.1
File Interpreter ABI Platform
boomtick_cli-0.12.1-py3-none-any.whl Python 3 none any Details

Total release size: 409.2 kB

Release files / boomtick_cli-0.12.1.tar.gz

Download URL boomtick_cli-0.12.1.tar.gz
Size 195.3 kB
Tags Source
SHA-256 checksum
How to use checksums
7bc0cd09b7dcfbf90caa923fdf3ee23e61489e21928327a40f0dca185271aecb
BLAKE2b-256 checksum
How to use checksums
ed8f19795e845c855bcb82eeda6aadb6ea4cc6726a12d97e0782da7c9ef9fc70
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.16

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 20, 2026.

Transparency log

Release files / boomtick_cli-0.12.1-py3-none-any.whl

Download URL boomtick_cli-0.12.1-py3-none-any.whl
Size 213.9 kB
Tags Python 3
SHA-256 checksum
How to use checksums
5bb33fea08fb722c988ed1a5b413c8d2c775895c59fb3ced8f1e730e69015fcc
BLAKE2b-256 checksum
How to use checksums
b35109f0554cb03d09fb2554e6710fdd1d40eccaf2943b9094552a217ba77cf5
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.16

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 20, 2026.

Transparency log

Security for boomtick-cli 0.12.1

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

Full provenance

All 2 files in this release have been uploaded with provenance metadata.

Select from 2 files

Attestation for boomtick_cli-0.12.1.tar.gz

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 20, 2026.

Transparency log

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

To learn more about protecting yourself from malicious actors, visit our package security documentation.

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page