---

date: 2026-07-16 tags: [boost, composer, claude-md, skills, commit-hygiene] status: active graduated_to:

composer require/install lets Boost's plugin mutate .claude/ and CLAUDE.md — check before committing

Symptom — After composer require pestphp/pest:5.x-dev, git status showed CLAUDE.md and boost.json modified and .claude/skills/pest-testing/SKILL.md deleted — none of which were the intended dependency change. Blind-committing "the composer change" would have removed a real Boost-managed skill and rewritten CLAUDE.md.

Root cause — laravel/boost registers a Composer plugin that regenerates its managed artifacts (boost.json, its bundled/managed skills, the Boost section of CLAUDE.md) on composer events. A version bump makes it re-emit those for the new package set, which can delete a managed skill file and rewrite docs as a side effect of an otherwise unrelated install.

Fix — Commit only the intended paths; restore the collateral first: git checkout -- CLAUDE.md boost.json .claude/skills/pest-testing/SKILL.md before staging (commit 06a84d4).

Guard — After any composer require/install in this repo, run git status and treat modified CLAUDE.md / boost.json and any deleted .claude/skills/** as boost collateral: restore it (or intentionally regenerate it as its own change), never let it ride along in a "composer bump" commit. Boost-managed skills carry metadata.author and are regenerated, not hand-owned (.claude/rules/skills.md).