Skip to main content

dev-tools

Developer tooling for the BoomTick repository. The primary entry point is td, but agents should always call boomtick-mcp Tier 1 tools first — td is the Tier 2 fallback. See .agents/AGENTS.md for the full tool hierarchy.


🚀 One-Step Setup

./setup-agent.sh

This setup script is now located at the repository root (not symlinked) and handles system tools, Node.js, pnpm, Python dependencies, Playwright, remote origin configuration, and git hook registration.


🔑 Environment Variables

Variable Required Purpose
GITHUB_TOKEN (string) Required Auth for gh and td gh ... commands (PR audits, comments, variables, status checks). Standard for GH Actions.
GITHUB_REPOSITORY (owner/repo) Recommended Ensures deterministic origin remote auto-configuration.
JULES_API_KEY Optional Enables td agent ... / td jules ... cloud workflows.
GEMINI_API_KEY Optional Enables Gemini-backed review/audit workflows.

Secret handling guidance

  • GitHub Actions / agent runners: store GITHUB_TOKEN, JULES_API_KEY, and GEMINI_API_KEY in repository or org Secrets.
  • Dev containers / local shells: export secrets before running setup/CLI:
export GITHUB_TOKEN="<token>"
export GITHUB_REPOSITORY="owner/repo"
# optional
export JULES_API_KEY="<key>"
export GEMINI_API_KEY="<key>"

Optional tuning variables

  • SKIP_GIT_HOOKS=1 — skip git hook execution (e.g. in CI).
  • SKIP_VALIDATION=1 — skip post-setup runtime validation.
  • NODE_MAJOR — override Node major used for apt installation (defaults to 24).

🧩 Workflow-Specific Setup

After ./setup-agent.sh, use the following workflow-specific setup:

1) Standard PR / Review Workflows

  • Plan a review (fetches context and audits):
    • td agent plan-review --pr <PR_NUMBER>
  • Submit audit results (after authoring the review in pr-review-<PR>.md):
    • td gh audit-pr <PR_NUMBER> --submit --execute
  • Pre-submit quality gate before push/merge:
    • td gh pre-submit

2) Jules Workflows

  • Required secret: JULES_API_KEY.
  • Optional context env var: JULES_SOURCE_ID (if your environment already knows the source mapping).
  • Typical commands:
    • td agent dispatch <BRANCH> "<TASK>"
    • td agent fix-ci --pr-number <PR> --execute
    • td agent sync

3) Headless / Bot Auditing

  • For batch auditing open PRs:
    • td gh audit-pr <PR_NUMBER> --fetch --audit --submit --execute
  • Ensure jq, gh, Python deps, and pnpm deps are installed (handled by setup script).

🗂️ Agent Context Index

.agent-context.json (repository root) is the pre-built index that boomtick-mcp reads on every tool call. It contains file_tree, cli_schema, and package_json metadata — built by scripts/build-repo-context.py.

The index is kept fresh automatically by the git hooks registered during ./setup-agent.sh:

  • .githooks/post-checkout — refreshes on branch switch
  • .githooks/post-merge — refreshes on pull/merge

To manually refresh:

pnpm run agent:prime

If the index is stale, MCP tools fall back to raw filesystem calls, bypassing the index and increasing token usage. Always refresh before running reviews or dispatching Jules sessions.


🤖 Agent / Jules GitHub Command Pattern

Always use boomtick-mcp Tier 1 tools first. td is the fallback when MCP is unavailable — not the default. See .agents/AGENTS.md for the full tool mapping table.

When td must be called directly, read the CLI schema from .agent-context.json rather than guessing flags or running --help:

# Extract schema for a specific subcommand before calling it
cat .agent-context.json | python3 -c "
import json, sys
schema = json.load(sys.stdin)
print(json.dumps(schema['cli_schema']['subcommands']['gh pr-diff'], indent=2))
"

Prefer repository CLI commands over raw gh:

# ✅ Preferred
td gh <repo-command>

# ⚠️ Only if td does not expose the operation
gh <command>

If auth fails, do not run gh auth login. Instead, set an environment secret named GITHUB_TOKEN.


✅ Verification Commands (Post-Setup)

node --version         # should match .node-version
pnpm --version         # should be 10.28.2
td doctor
pnpm run check:runtime-files
gh auth status

🆘 Troubleshooting

GitHub CLI not authenticated

gh issue create --title "<title>" --body "<details>"

If auth fails, report this exact issue (do not run interactive auth):

GitHub CLI is not authenticated. Please add an environment secret named GITHUB_TOKEN with a repo-scoped GitHub token.

.agent-context.json stale or missing

pnpm run agent:prime

Then re-read before proceeding with any agent operation.

pnpm / Node mismatch

Stop and report the mismatch. Do not attempt to change runtime versions unless explicitly instructed to update the runtime contract.


🚀 Repository CLI (td)

dev-tools/td is the Tier 2 unified entry point for local repository automation. All available subcommands and flags are defined in dev-tools/cli-schema.json (also embedded in .agent-context.json under cli_schema). That file is the single source of truth — never use --help to discover flags.

Key subcommand groups:

Group Description
doctor Runtime consistency check
gh GitHub operations (PRs, issues, audits, conflicts)
repo Repository operations (CI logs, Playwright)
agent / jules Jules agent session management

Metadata

Release files for boomtick-cli 0.13.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for boomtick-cli 0.13.0
File Size Uploaded Provenance
boomtick_cli-0.13.0.tar.gz 210.7 kB With provenance Details

Built distribution (wheel)

Table of built distributions (wheels) for boomtick-cli 0.13.0
File Interpreter ABI Platform
boomtick_cli-0.13.0-py3-none-any.whl Python 3 none any Details

Total release size: 439.9 kB

Release files / boomtick_cli-0.13.0.tar.gz

Download URL boomtick_cli-0.13.0.tar.gz
Size 210.7 kB
Tags Source
SHA-256 checksum
How to use checksums
64781e4bd0a02133f690037f688ef230f33bf5550887a17ce392aeea7a238113
BLAKE2b-256 checksum
How to use checksums
bc6077b0c59e398433db72555ae4846616075dc5c37adf2fc215d1caa11ff3ef
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.16

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 22, 2026.

Transparency log

Release files / boomtick_cli-0.13.0-py3-none-any.whl

Download URL boomtick_cli-0.13.0-py3-none-any.whl
Size 229.2 kB
Tags Python 3
SHA-256 checksum
How to use checksums
721051f1b49961437a45a33a2f77159e3b5da176f097c3f4ffa6f4b12bc6fee3
BLAKE2b-256 checksum
How to use checksums
14a58962b1d552ab10e5f84fbb7ad01782c1366500b9a0e0342c9533746e8e3f
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.16

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 22, 2026.

Transparency log

Security for boomtick-cli 0.13.0

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

Full provenance

All 2 files in this release have been uploaded with provenance metadata.

Select from 2 files

Attestation for boomtick_cli-0.13.0.tar.gz

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 22, 2026.

Transparency log

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

To learn more about protecting yourself from malicious actors, visit our package security documentation.

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page