Skip to main content

dev-tools

Developer tooling for the BoomTick repository. The primary entry point is td, but agents should always call boomtick-mcp Tier 1 tools first — td is the Tier 2 fallback. See .agents/AGENTS.md for the full tool hierarchy.


🚀 One-Step Setup

./setup-agent.sh

This setup script is now located at the repository root (not symlinked) and handles system tools, Node.js, pnpm, Python dependencies, Playwright, remote origin configuration, and git hook registration.


🔑 Environment Variables

Variable Required Purpose
GITHUB_TOKEN (string) Required Auth for gh and td gh ... commands (PR audits, comments, variables, status checks). Standard for GH Actions.
GITHUB_REPOSITORY (owner/repo) Recommended Ensures deterministic origin remote auto-configuration.
JULES_API_KEY Optional Enables td agent ... / td jules ... cloud workflows.
GEMINI_API_KEY Optional Enables Gemini-backed review/audit workflows.

Secret handling guidance

  • GitHub Actions / agent runners: store GITHUB_TOKEN, JULES_API_KEY, and GEMINI_API_KEY in repository or org Secrets.
  • Dev containers / local shells: export secrets before running setup/CLI:
export GITHUB_TOKEN="<token>"
export GITHUB_REPOSITORY="owner/repo"
# optional
export JULES_API_KEY="<key>"
export GEMINI_API_KEY="<key>"

Optional tuning variables

  • SKIP_GIT_HOOKS=1 — skip git hook execution (e.g. in CI).
  • SKIP_VALIDATION=1 — skip post-setup runtime validation.
  • NODE_MAJOR — override Node major used for apt installation (defaults to 24).

🧩 Workflow-Specific Setup

After ./setup-agent.sh, use the following workflow-specific setup:

1) Standard PR / Review Workflows

  • Plan a review (fetches context and audits):
    • td agent plan-review --pr <PR_NUMBER>
  • Submit audit results (after authoring the review in pr-review-<PR>.md):
    • td gh audit-pr <PR_NUMBER> --submit --execute
  • Pre-submit quality gate before push/merge:
    • td gh pre-submit

2) Jules Workflows

  • Required secret: JULES_API_KEY.
  • Optional context env var: JULES_SOURCE_ID (if your environment already knows the source mapping).
  • Typical commands:
    • td agent dispatch <BRANCH> "<TASK>"
    • td agent fix-ci --pr-number <PR> --execute
    • td agent sync

3) Headless / Bot Auditing

  • For batch auditing open PRs:
    • td gh audit-pr <PR_NUMBER> --fetch --audit --submit --execute
  • Ensure jq, gh, Python deps, and pnpm deps are installed (handled by setup script).

🗂️ Agent Context Index

.agent-context.json (repository root) is the pre-built index that boomtick-mcp reads on every tool call. It contains file_tree, cli_schema, and package_json metadata — built by scripts/build-repo-context.py.

The index is kept fresh automatically by the git hooks registered during ./setup-agent.sh:

  • .githooks/post-checkout — refreshes on branch switch
  • .githooks/post-merge — refreshes on pull/merge

To manually refresh:

pnpm run agent:prime

If the index is stale, MCP tools fall back to raw filesystem calls, bypassing the index and increasing token usage. Always refresh before running reviews or dispatching Jules sessions.


🤖 Agent / Jules GitHub Command Pattern

Always use boomtick-mcp Tier 1 tools first. td is the fallback when MCP is unavailable — not the default. See .agents/AGENTS.md for the full tool mapping table.

When td must be called directly, read the CLI schema from .agent-context.json rather than guessing flags or running --help:

# Extract schema for a specific subcommand before calling it
cat .agent-context.json | python3 -c "
import json, sys
schema = json.load(sys.stdin)
print(json.dumps(schema['cli_schema']['subcommands']['gh pr-diff'], indent=2))
"

Prefer repository CLI commands over raw gh:

# ✅ Preferred
td gh <repo-command>

# ⚠️ Only if td does not expose the operation
gh <command>

If auth fails, do not run gh auth login. Instead, set an environment secret named GITHUB_TOKEN.


✅ Verification Commands (Post-Setup)

node --version         # should match .node-version
pnpm --version         # should be 10.28.2
td doctor
pnpm run check:runtime-files
gh auth status

🆘 Troubleshooting

GitHub CLI not authenticated

gh issue create --title "<title>" --body "<details>"

If auth fails, report this exact issue (do not run interactive auth):

GitHub CLI is not authenticated. Please add an environment secret named GITHUB_TOKEN with a repo-scoped GitHub token.

.agent-context.json stale or missing

pnpm run agent:prime

Then re-read before proceeding with any agent operation.

pnpm / Node mismatch

Stop and report the mismatch. Do not attempt to change runtime versions unless explicitly instructed to update the runtime contract.


🚀 Repository CLI (td)

dev-tools/td is the Tier 2 unified entry point for local repository automation. All available subcommands and flags are defined in dev-tools/cli-schema.json (also embedded in .agent-context.json under cli_schema). That file is the single source of truth — never use --help to discover flags.

Key subcommand groups:

Group Description
doctor Runtime consistency check
gh GitHub operations (PRs, issues, audits, conflicts)
repo Repository operations (CI logs, Playwright)
agent / jules Jules agent session management

Metadata

Release files for boomtick-cli 0.13.1

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for boomtick-cli 0.13.1
File Size Uploaded Provenance
boomtick_cli-0.13.1.tar.gz 211.0 kB With provenance Details

Built distribution (wheel)

Table of built distributions (wheels) for boomtick-cli 0.13.1
File Interpreter ABI Platform
boomtick_cli-0.13.1-py3-none-any.whl Python 3 none any Details

Total release size: 440.6 kB

Release files / boomtick_cli-0.13.1.tar.gz

Download URL boomtick_cli-0.13.1.tar.gz
Size 211.0 kB
Tags Source
SHA-256 checksum
How to use checksums
6d9f9278ca562ec0dd4c996bd661e97b7e2702f12e01daab1bd1bd87622219cc
BLAKE2b-256 checksum
How to use checksums
b200699037d110c94794906adcc8110efdc731b74d1091c660f8df5f2f1501d0
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.16

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 23, 2026.

Transparency log

Release files / boomtick_cli-0.13.1-py3-none-any.whl

Download URL boomtick_cli-0.13.1-py3-none-any.whl
Size 229.6 kB
Tags Python 3
SHA-256 checksum
How to use checksums
40f437ec34e0e38b2cadad2460561d1d988233ef517fb1e373918d397d4b209f
BLAKE2b-256 checksum
How to use checksums
df38ec06217308cbc0f48797d1beadb9ffdf9648f5026879c89f5ea228e779eb
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.16

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 23, 2026.

Transparency log

Security for boomtick-cli 0.13.1

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

Full provenance

All 2 files in this release have been uploaded with provenance metadata.

Select from 2 files

Attestation for boomtick_cli-0.13.1.tar.gz

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 23, 2026.

Transparency log

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

To learn more about protecting yourself from malicious actors, visit our package security documentation.

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page