sandermuller/boost-core

AI agent configuration sync for PHP projects. Author skills and guidelines once, publish to every agent.

0.3.4 2026-05-18 14:52 UTC

Requires

• php: ^8.3
• composer-plugin-api: ^2.6
• composer-runtime-api: ^2.2
• laravel/prompts: ^0.3
• nikic/php-parser: ^5.0
• symfony/console: ^7.0
• symfony/finder: ^7.0
• symfony/process: ^7.0
• symfony/yaml: ^7.0

Requires (Dev)

• composer/composer: ^2.6
• laravel/pao: ^1.0
• laravel/pint: ^1.29
• mrpunyapal/rector-pest: ^0.2
• nunomaduro/collision: ^8.0
• orchestra/testbench: ^9.0||^10.0||^11.0
• pestphp/pest: ^4.0
• pestphp/pest-plugin-arch: ^4.0
• phpstan/extension-installer: ^1.4
• phpstan/phpstan: ^2.0
• phpstan/phpstan-deprecation-rules: ^2.0
• phpstan/phpstan-phpunit: ^2.0
• phpstan/phpstan-strict-rules: ^2.0
• rector/rector: ^2.4
• rector/type-perfect: ^2.1
• sandermuller/package-boost: ^0.15
• spaze/phpstan-disallowed-calls: ^4.10
• stolt/lean-package-validator: ^5.7
• symplify/phpstan-extensions: ^12.0
• tomasvotruba/cognitive-complexity: ^1.1
• tomasvotruba/type-coverage: ^2.1

MIT

• Sander Muller

• php
• cursor
• agents
• ai
• skills
• mcp
• developer-tools
• copilot
• claude
• sandermuller
• boost-core

README

AI agent configuration sync for PHP projects. Author skills and guidelines once in .ai/, publish to nine agents (Claude Code, Cursor, Copilot, Codex, Gemini, Junie, Kiro, OpenCode, Amp). Framework-free PHP, allowlist-based vendor trust, Rector-style explicit commands.

Install

You don't usually install boost-core directly — it comes in as a dep of one of the bundle packages that match your role:

# PHP application developer
composer require --dev sandermuller/project-boost

# Laravel application developer — use the original, this family doesn't replace it
composer require --dev laravel/boost

# Framework-agnostic Composer package author
composer require --dev sandermuller/package-boost-php

# Laravel package author
composer require --dev sandermuller/package-boost-laravel

Direct install for tooling authors who want to ship their own skill bundle:

composer require --dev sandermuller/boost-core

Usage

composer boost:install   # generate boost.php (if missing) + interactive picker for agents + vendor allowlist
composer boost:sync      # fan out to selected agents

After install, every composer install / composer update re-runs boost:sync automatically (post-autoload-dump). Set BOOST_SKIP_AUTOSYNC=1 to disable.

For tooling authors who want to publish their own skills to every AI agent on the user's machine:

composer boost:sync --scope=user   # ~/.{agent}/skills/<vendor>__<package>/<skill>/SKILL.md

In composer global context (composer global require <skill-bearing-package>), the plugin auto-detects the global install and runs user-scope sync for every globally-installed package shipping resources/boost/skills/ — no manual --scope=user invocation required. Paths are namespaced by the full vendor/package slug (with / replaced by __, a sequence forbidden by the Composer name spec so distinct packages always produce distinct slugs), so vendor-a/foo and vendor-b/foo coexist cleanly under their own dirs.

Composer script callback (for plugin-package authors)

SanderMuller\BoostCore\Scripts\BoostAutoSync::run is a cross-platform Composer script callback that consumer packages can wire into their own post-install-cmd / post-update-cmd hooks:

"scripts": {
    "post-install-cmd": [
        "SanderMuller\\BoostCore\\Scripts\\BoostAutoSync::run"
    ],
    "post-update-cmd": [
        "SanderMuller\\BoostCore\\Scripts\\BoostAutoSync::run"
    ]
}

It checks Event::isDevMode(), resolves composer config.bin-dir, runs vendor/bin/boost sync and surfaces non-zero exits through Composer's IO. Works on Windows + Unix. Honors BOOST_SKIP_AUTOSYNC=1 (same escape hatch as the plugin's auto-sync hook). The plugin's onPostAutoloadDump already runs sync for end-user installs — this callback is for plugin packages in the boost-* family that want an explicit, cross-platform script entry of their own.

For user-invoked scripts (composer sync-ai, etc.) where silence on success reads as a no-op, use BoostAutoSync::runWithSummary instead — same behaviour but streams the binary's one-line success summary through Composer's IO:

"scripts": {
    "post-install-cmd": ["SanderMuller\\BoostCore\\Scripts\\BoostAutoSync::run"],
    "post-update-cmd":  ["SanderMuller\\BoostCore\\Scripts\\BoostAutoSync::run"],
    "sync-ai":          ["SanderMuller\\BoostCore\\Scripts\\BoostAutoSync::runWithSummary"]
}

Managed .gitignore

boost:sync maintains a managed block in .gitignore so generated agent dirs (.claude/skills/, .cursor/skills/, CLAUDE.md, AGENTS.md, ...) stay out of version control. Edit skills in .ai/ only; the fan-out regenerates on next install.

Opt out per project:

return BoostConfig::configure()
    ->withGitignoreManagement(false)
    ->withAgents([...]);

Or one-off via env var (useful for CI / ephemeral Docker installs):

BOOST_SKIP_GITIGNORE=1 composer install

Testing

composer test

That runs the full Pest suite (unit + integration, including real composer install subprocesses for the standalone-bin, plugin-capability, and global-context surfaces). Coverage report via composer test-coverage.

Upgrading

See UPGRADING.md for breaking-change migrations between majors/minors.

Note

The FileEmitter plugin contract is @experimental — the shape will change before v1.0 stable.

Changelog

See CHANGELOG.md for the full release history. The GitHub releases page has per-version notes.

Contributing

See CONTRIBUTING.md for development setup, test conventions, and the pre-release gauntlet.

Security

If you find a security issue, please email [e-mail] rather than filing a public issue. See SECURITY.md for the disclosure policy.

Credits

• Sander Muller
• All contributors

Heavy inspiration from laravel/boost — this is its framework-free sibling.

License

MIT. See LICENSE.