@mc-and-his-agents/loom-installer 0.1.35 → 0.1.37

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mc-and-his-agents/loom-installer",
-  "version": "0.1.35",
+  "version": "0.1.37",
   "description": "Node installer for Loom plugin and single-skill installation surfaces.",
   "type": "module",
   "bin": {

package/payload/manifest.json

@@ -2,9 +2,9 @@
   "schema_version": "loom-installer-payload/v1",
   "loom_version": "0.4.0",
   "source_repository": "https://github.com/MC-and-his-Agents/Loom",
-  "source_commit": "caf16c628cee5a632ace111fa0d192191ea12a9c",
+  "source_commit": "e6175667069a99b5a49ea9758f71ffe4961f899b",
   "source_ref": "main",
-  "built_at": "2026-04-27T15:02:07+08:00",
+  "built_at": "2026-04-27T15:59:30+08:00",
   "runtime": {
     "python_minimum": "3.10",
     "python_recommended": "3.11+"
@@ -623,23 +623,23 @@
     },
     {
       "path": "plugin/loom/skills/shared/scripts/fact_chain_support.py",
-      "bytes": 21694,
-      "sha256": "406352215e9ff1c582d750761b911bd227c99b3cc29d3710143554ced7f9e080"
+      "bytes": 21748,
+      "sha256": "8ec28a37277dbf4e6e0af5965cf98da4ec3e8a0b29cb325309c08b22ab976a91"
     },
     {
       "path": "plugin/loom/skills/shared/scripts/governance_surface.py",
-      "bytes": 56201,
-      "sha256": "82109bad507ea760c7df3a401b648b34c35da03f8f85eb40481834e44b29ed0f"
+      "bytes": 56941,
+      "sha256": "fcd116cdadbe674f13fbe841e5af86d8bb48fe6c924305949ea1ed1abc955d44"
     },
     {
       "path": "plugin/loom/skills/shared/scripts/loom_check.py",
-      "bytes": 331479,
-      "sha256": "a5916d824ef9d6ef2d8f18378758cc072b3af7ba5cb67923b32dea16c2c5786d"
+      "bytes": 338798,
+      "sha256": "6c31df1995034f10c7dd769b5c174a3e580f3078e586d53faa6b9994c3d7bb98"
     },
     {
       "path": "plugin/loom/skills/shared/scripts/loom_flow.py",
-      "bytes": 332816,
-      "sha256": "55f9d625dfb3cf35e7d0f849878700b29a099975831b5caccb3ce87fa4134def"
+      "bytes": 334363,
+      "sha256": "e9b376551600383e95e4f707557bb957edf51cd9ee2263587b8b6109088b737c"
     },
     {
       "path": "plugin/loom/skills/shared/scripts/loom_init.py",
@@ -658,8 +658,8 @@
     },
     {
       "path": "plugin/loom/skills/shared/scripts/runtime_state.py",
-      "bytes": 19697,
-      "sha256": "5c5e096dbea072ab8e4f305ac06ee5d983e0bade519f6bea7fd119a92de52f09"
+      "bytes": 21030,
+      "sha256": "3375830ede9bec65083d9ee6cfac5f5a7e3bd781ef90c78a087c39d37f2cfab2"
     },
     {
       "path": "plugin/loom/skills/upgrade-contract.json",
@@ -1213,23 +1213,23 @@
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/scripts/fact_chain_support.py",
-      "bytes": 21694,
-      "sha256": "406352215e9ff1c582d750761b911bd227c99b3cc29d3710143554ced7f9e080"
+      "bytes": 21748,
+      "sha256": "8ec28a37277dbf4e6e0af5965cf98da4ec3e8a0b29cb325309c08b22ab976a91"
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/scripts/governance_surface.py",
-      "bytes": 56201,
-      "sha256": "82109bad507ea760c7df3a401b648b34c35da03f8f85eb40481834e44b29ed0f"
+      "bytes": 56941,
+      "sha256": "fcd116cdadbe674f13fbe841e5af86d8bb48fe6c924305949ea1ed1abc955d44"
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 331479,
-      "sha256": "a5916d824ef9d6ef2d8f18378758cc072b3af7ba5cb67923b32dea16c2c5786d"
+      "bytes": 338798,
+      "sha256": "6c31df1995034f10c7dd769b5c174a3e580f3078e586d53faa6b9994c3d7bb98"
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/scripts/loom_flow.py",
-      "bytes": 332816,
-      "sha256": "55f9d625dfb3cf35e7d0f849878700b29a099975831b5caccb3ce87fa4134def"
+      "bytes": 334363,
+      "sha256": "e9b376551600383e95e4f707557bb957edf51cd9ee2263587b8b6109088b737c"
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/scripts/loom_init.py",
@@ -1248,8 +1248,8 @@
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/scripts/runtime_state.py",
-      "bytes": 19697,
-      "sha256": "5c5e096dbea072ab8e4f305ac06ee5d983e0bade519f6bea7fd119a92de52f09"
+      "bytes": 21030,
+      "sha256": "3375830ede9bec65083d9ee6cfac5f5a7e3bd781ef90c78a087c39d37f2cfab2"
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/upgrade-contract.json",
@@ -1833,23 +1833,23 @@
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/scripts/fact_chain_support.py",
-      "bytes": 21694,
-      "sha256": "406352215e9ff1c582d750761b911bd227c99b3cc29d3710143554ced7f9e080"
+      "bytes": 21748,
+      "sha256": "8ec28a37277dbf4e6e0af5965cf98da4ec3e8a0b29cb325309c08b22ab976a91"
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/scripts/governance_surface.py",
-      "bytes": 56201,
-      "sha256": "82109bad507ea760c7df3a401b648b34c35da03f8f85eb40481834e44b29ed0f"
+      "bytes": 56941,
+      "sha256": "fcd116cdadbe674f13fbe841e5af86d8bb48fe6c924305949ea1ed1abc955d44"
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 331479,
-      "sha256": "a5916d824ef9d6ef2d8f18378758cc072b3af7ba5cb67923b32dea16c2c5786d"
+      "bytes": 338798,
+      "sha256": "6c31df1995034f10c7dd769b5c174a3e580f3078e586d53faa6b9994c3d7bb98"
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/scripts/loom_flow.py",
-      "bytes": 332816,
-      "sha256": "55f9d625dfb3cf35e7d0f849878700b29a099975831b5caccb3ce87fa4134def"
+      "bytes": 334363,
+      "sha256": "e9b376551600383e95e4f707557bb957edf51cd9ee2263587b8b6109088b737c"
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/scripts/loom_init.py",
@@ -1868,8 +1868,8 @@
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/scripts/runtime_state.py",
-      "bytes": 19697,
-      "sha256": "5c5e096dbea072ab8e4f305ac06ee5d983e0bade519f6bea7fd119a92de52f09"
+      "bytes": 21030,
+      "sha256": "3375830ede9bec65083d9ee6cfac5f5a7e3bd781ef90c78a087c39d37f2cfab2"
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/upgrade-contract.json",
@@ -2453,23 +2453,23 @@
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/scripts/fact_chain_support.py",
-      "bytes": 21694,
-      "sha256": "406352215e9ff1c582d750761b911bd227c99b3cc29d3710143554ced7f9e080"
+      "bytes": 21748,
+      "sha256": "8ec28a37277dbf4e6e0af5965cf98da4ec3e8a0b29cb325309c08b22ab976a91"
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/scripts/governance_surface.py",
-      "bytes": 56201,
-      "sha256": "82109bad507ea760c7df3a401b648b34c35da03f8f85eb40481834e44b29ed0f"
+      "bytes": 56941,
+      "sha256": "fcd116cdadbe674f13fbe841e5af86d8bb48fe6c924305949ea1ed1abc955d44"
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 331479,
-      "sha256": "a5916d824ef9d6ef2d8f18378758cc072b3af7ba5cb67923b32dea16c2c5786d"
+      "bytes": 338798,
+      "sha256": "6c31df1995034f10c7dd769b5c174a3e580f3078e586d53faa6b9994c3d7bb98"
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/scripts/loom_flow.py",
-      "bytes": 332816,
-      "sha256": "55f9d625dfb3cf35e7d0f849878700b29a099975831b5caccb3ce87fa4134def"
+      "bytes": 334363,
+      "sha256": "e9b376551600383e95e4f707557bb957edf51cd9ee2263587b8b6109088b737c"
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/scripts/loom_init.py",
@@ -2488,8 +2488,8 @@
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/scripts/runtime_state.py",
-      "bytes": 19697,
-      "sha256": "5c5e096dbea072ab8e4f305ac06ee5d983e0bade519f6bea7fd119a92de52f09"
+      "bytes": 21030,
+      "sha256": "3375830ede9bec65083d9ee6cfac5f5a7e3bd781ef90c78a087c39d37f2cfab2"
     },
     {
       "path": "skills/loom-init/.loom-runtime/upgrade-contract.json",
@@ -3078,23 +3078,23 @@
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/scripts/fact_chain_support.py",
-      "bytes": 21694,
-      "sha256": "406352215e9ff1c582d750761b911bd227c99b3cc29d3710143554ced7f9e080"
+      "bytes": 21748,
+      "sha256": "8ec28a37277dbf4e6e0af5965cf98da4ec3e8a0b29cb325309c08b22ab976a91"
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/scripts/governance_surface.py",
-      "bytes": 56201,
-      "sha256": "82109bad507ea760c7df3a401b648b34c35da03f8f85eb40481834e44b29ed0f"
+      "bytes": 56941,
+      "sha256": "fcd116cdadbe674f13fbe841e5af86d8bb48fe6c924305949ea1ed1abc955d44"
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 331479,
-      "sha256": "a5916d824ef9d6ef2d8f18378758cc072b3af7ba5cb67923b32dea16c2c5786d"
+      "bytes": 338798,
+      "sha256": "6c31df1995034f10c7dd769b5c174a3e580f3078e586d53faa6b9994c3d7bb98"
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/scripts/loom_flow.py",
-      "bytes": 332816,
-      "sha256": "55f9d625dfb3cf35e7d0f849878700b29a099975831b5caccb3ce87fa4134def"
+      "bytes": 334363,
+      "sha256": "e9b376551600383e95e4f707557bb957edf51cd9ee2263587b8b6109088b737c"
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/scripts/loom_init.py",
@@ -3113,8 +3113,8 @@
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/scripts/runtime_state.py",
-      "bytes": 19697,
-      "sha256": "5c5e096dbea072ab8e4f305ac06ee5d983e0bade519f6bea7fd119a92de52f09"
+      "bytes": 21030,
+      "sha256": "3375830ede9bec65083d9ee6cfac5f5a7e3bd781ef90c78a087c39d37f2cfab2"
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/upgrade-contract.json",
@@ -3698,23 +3698,23 @@
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/scripts/fact_chain_support.py",
-      "bytes": 21694,
-      "sha256": "406352215e9ff1c582d750761b911bd227c99b3cc29d3710143554ced7f9e080"
+      "bytes": 21748,
+      "sha256": "8ec28a37277dbf4e6e0af5965cf98da4ec3e8a0b29cb325309c08b22ab976a91"
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/scripts/governance_surface.py",
-      "bytes": 56201,
-      "sha256": "82109bad507ea760c7df3a401b648b34c35da03f8f85eb40481834e44b29ed0f"
+      "bytes": 56941,
+      "sha256": "fcd116cdadbe674f13fbe841e5af86d8bb48fe6c924305949ea1ed1abc955d44"
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 331479,
-      "sha256": "a5916d824ef9d6ef2d8f18378758cc072b3af7ba5cb67923b32dea16c2c5786d"
+      "bytes": 338798,
+      "sha256": "6c31df1995034f10c7dd769b5c174a3e580f3078e586d53faa6b9994c3d7bb98"
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/scripts/loom_flow.py",
-      "bytes": 332816,
-      "sha256": "55f9d625dfb3cf35e7d0f849878700b29a099975831b5caccb3ce87fa4134def"
+      "bytes": 334363,
+      "sha256": "e9b376551600383e95e4f707557bb957edf51cd9ee2263587b8b6109088b737c"
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/scripts/loom_init.py",
@@ -3733,8 +3733,8 @@
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/scripts/runtime_state.py",
-      "bytes": 19697,
-      "sha256": "5c5e096dbea072ab8e4f305ac06ee5d983e0bade519f6bea7fd119a92de52f09"
+      "bytes": 21030,
+      "sha256": "3375830ede9bec65083d9ee6cfac5f5a7e3bd781ef90c78a087c39d37f2cfab2"
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/upgrade-contract.json",
@@ -4318,23 +4318,23 @@
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/scripts/fact_chain_support.py",
-      "bytes": 21694,
-      "sha256": "406352215e9ff1c582d750761b911bd227c99b3cc29d3710143554ced7f9e080"
+      "bytes": 21748,
+      "sha256": "8ec28a37277dbf4e6e0af5965cf98da4ec3e8a0b29cb325309c08b22ab976a91"
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/scripts/governance_surface.py",
-      "bytes": 56201,
-      "sha256": "82109bad507ea760c7df3a401b648b34c35da03f8f85eb40481834e44b29ed0f"
+      "bytes": 56941,
+      "sha256": "fcd116cdadbe674f13fbe841e5af86d8bb48fe6c924305949ea1ed1abc955d44"
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 331479,
-      "sha256": "a5916d824ef9d6ef2d8f18378758cc072b3af7ba5cb67923b32dea16c2c5786d"
+      "bytes": 338798,
+      "sha256": "6c31df1995034f10c7dd769b5c174a3e580f3078e586d53faa6b9994c3d7bb98"
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/scripts/loom_flow.py",
-      "bytes": 332816,
-      "sha256": "55f9d625dfb3cf35e7d0f849878700b29a099975831b5caccb3ce87fa4134def"
+      "bytes": 334363,
+      "sha256": "e9b376551600383e95e4f707557bb957edf51cd9ee2263587b8b6109088b737c"
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/scripts/loom_init.py",
@@ -4353,8 +4353,8 @@
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/scripts/runtime_state.py",
-      "bytes": 19697,
-      "sha256": "5c5e096dbea072ab8e4f305ac06ee5d983e0bade519f6bea7fd119a92de52f09"
+      "bytes": 21030,
+      "sha256": "3375830ede9bec65083d9ee6cfac5f5a7e3bd781ef90c78a087c39d37f2cfab2"
     },
     {
       "path": "skills/loom-resume/.loom-runtime/upgrade-contract.json",
@@ -4938,23 +4938,23 @@
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/scripts/fact_chain_support.py",
-      "bytes": 21694,
-      "sha256": "406352215e9ff1c582d750761b911bd227c99b3cc29d3710143554ced7f9e080"
+      "bytes": 21748,
+      "sha256": "8ec28a37277dbf4e6e0af5965cf98da4ec3e8a0b29cb325309c08b22ab976a91"
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/scripts/governance_surface.py",
-      "bytes": 56201,
-      "sha256": "82109bad507ea760c7df3a401b648b34c35da03f8f85eb40481834e44b29ed0f"
+      "bytes": 56941,
+      "sha256": "fcd116cdadbe674f13fbe841e5af86d8bb48fe6c924305949ea1ed1abc955d44"
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 331479,
-      "sha256": "a5916d824ef9d6ef2d8f18378758cc072b3af7ba5cb67923b32dea16c2c5786d"
+      "bytes": 338798,
+      "sha256": "6c31df1995034f10c7dd769b5c174a3e580f3078e586d53faa6b9994c3d7bb98"
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/scripts/loom_flow.py",
-      "bytes": 332816,
-      "sha256": "55f9d625dfb3cf35e7d0f849878700b29a099975831b5caccb3ce87fa4134def"
+      "bytes": 334363,
+      "sha256": "e9b376551600383e95e4f707557bb957edf51cd9ee2263587b8b6109088b737c"
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/scripts/loom_init.py",
@@ -4973,8 +4973,8 @@
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/scripts/runtime_state.py",
-      "bytes": 19697,
-      "sha256": "5c5e096dbea072ab8e4f305ac06ee5d983e0bade519f6bea7fd119a92de52f09"
+      "bytes": 21030,
+      "sha256": "3375830ede9bec65083d9ee6cfac5f5a7e3bd781ef90c78a087c39d37f2cfab2"
     },
     {
       "path": "skills/loom-retire/.loom-runtime/upgrade-contract.json",
@@ -5558,23 +5558,23 @@
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/scripts/fact_chain_support.py",
-      "bytes": 21694,
-      "sha256": "406352215e9ff1c582d750761b911bd227c99b3cc29d3710143554ced7f9e080"
+      "bytes": 21748,
+      "sha256": "8ec28a37277dbf4e6e0af5965cf98da4ec3e8a0b29cb325309c08b22ab976a91"
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/scripts/governance_surface.py",
-      "bytes": 56201,
-      "sha256": "82109bad507ea760c7df3a401b648b34c35da03f8f85eb40481834e44b29ed0f"
+      "bytes": 56941,
+      "sha256": "fcd116cdadbe674f13fbe841e5af86d8bb48fe6c924305949ea1ed1abc955d44"
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 331479,
-      "sha256": "a5916d824ef9d6ef2d8f18378758cc072b3af7ba5cb67923b32dea16c2c5786d"
+      "bytes": 338798,
+      "sha256": "6c31df1995034f10c7dd769b5c174a3e580f3078e586d53faa6b9994c3d7bb98"
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/scripts/loom_flow.py",
-      "bytes": 332816,
-      "sha256": "55f9d625dfb3cf35e7d0f849878700b29a099975831b5caccb3ce87fa4134def"
+      "bytes": 334363,
+      "sha256": "e9b376551600383e95e4f707557bb957edf51cd9ee2263587b8b6109088b737c"
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/scripts/loom_init.py",
@@ -5593,8 +5593,8 @@
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/scripts/runtime_state.py",
-      "bytes": 19697,
-      "sha256": "5c5e096dbea072ab8e4f305ac06ee5d983e0bade519f6bea7fd119a92de52f09"
+      "bytes": 21030,
+      "sha256": "3375830ede9bec65083d9ee6cfac5f5a7e3bd781ef90c78a087c39d37f2cfab2"
     },
     {
       "path": "skills/loom-review/.loom-runtime/upgrade-contract.json",
@@ -6178,23 +6178,23 @@
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/scripts/fact_chain_support.py",
-      "bytes": 21694,
-      "sha256": "406352215e9ff1c582d750761b911bd227c99b3cc29d3710143554ced7f9e080"
+      "bytes": 21748,
+      "sha256": "8ec28a37277dbf4e6e0af5965cf98da4ec3e8a0b29cb325309c08b22ab976a91"
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/scripts/governance_surface.py",
-      "bytes": 56201,
-      "sha256": "82109bad507ea760c7df3a401b648b34c35da03f8f85eb40481834e44b29ed0f"
+      "bytes": 56941,
+      "sha256": "fcd116cdadbe674f13fbe841e5af86d8bb48fe6c924305949ea1ed1abc955d44"
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 331479,
-      "sha256": "a5916d824ef9d6ef2d8f18378758cc072b3af7ba5cb67923b32dea16c2c5786d"
+      "bytes": 338798,
+      "sha256": "6c31df1995034f10c7dd769b5c174a3e580f3078e586d53faa6b9994c3d7bb98"
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/scripts/loom_flow.py",
-      "bytes": 332816,
-      "sha256": "55f9d625dfb3cf35e7d0f849878700b29a099975831b5caccb3ce87fa4134def"
+      "bytes": 334363,
+      "sha256": "e9b376551600383e95e4f707557bb957edf51cd9ee2263587b8b6109088b737c"
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/scripts/loom_init.py",
@@ -6213,8 +6213,8 @@
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/scripts/runtime_state.py",
-      "bytes": 19697,
-      "sha256": "5c5e096dbea072ab8e4f305ac06ee5d983e0bade519f6bea7fd119a92de52f09"
+      "bytes": 21030,
+      "sha256": "3375830ede9bec65083d9ee6cfac5f5a7e3bd781ef90c78a087c39d37f2cfab2"
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/upgrade-contract.json",

package/payload/plugin/loom/skills/shared/scripts/fact_chain_support.py

@@ -195,12 +195,12 @@ def resolve_repo_relative_path(target_root: Path, relative: str, *, label: str)
     if candidate_raw.is_absolute():
         return None, [f"{label} must be repo-relative, got absolute path: {locator}"]
     if ".." in candidate_raw.parts:
-        return None, [f"{label} must stay inside the target repository: {locator}"]
+        return None, [f"{label} must stay inside the target repository and within the target root: {locator}"]
     candidate = (target_root / candidate_raw).resolve()
     try:
         candidate.relative_to(target_root.resolve())
     except ValueError:
-        return None, [f"{label} must stay inside the target repository: {locator}"]
+        return None, [f"{label} must stay inside the target repository and within the target root: {locator}"]
     return candidate, []
 
 

package/payload/plugin/loom/skills/shared/scripts/governance_surface.py

@@ -8,6 +8,7 @@ import re
 import subprocess
 from pathlib import Path
 from typing import Any
+from urllib.parse import quote
 
 from runtime_paths import installed_skill_script
 
@@ -357,7 +358,7 @@ def detect_github_repo(root: Path) -> tuple[str | None, str | None]:
     remote = git_remote_origin(root)
     if not remote:
         return None, None
-    match = re.search(r"github\.com[:/](?P<owner>[^/]+)/(?P<repo>[^/.]+)(?:\.git)?$", remote)
+    match = re.search(r"github\.com[:/](?P<owner>[^/]+)/(?P<repo>[^/]+?)(?:\.git)?$", remote)
     if not match:
         return None, None
     return match.group("owner"), match.group("repo")
@@ -474,6 +475,16 @@ def relative_locator_from_value(root: Path, raw_locator: object) -> str | None:
     return str(locator_path)
 
 
+def locator_boundary_error(raw_locator: object, *, label: str) -> str:
+    if not isinstance(raw_locator, str) or not raw_locator.strip():
+        return f"{label} must be a non-empty string"
+    locator = raw_locator.strip()
+    locator_path = Path(locator)
+    if locator_path.is_absolute() or ".." in locator_path.parts:
+        return f"{label} must stay within the repository root: {locator}"
+    return f"{label} must stay within the repository root: {locator}"
+
+
 def resolve_locator(root: Path, raw_locator: object) -> tuple[str | None, Path | None]:
     locator = relative_locator_from_value(root, raw_locator)
     if locator is None:
@@ -494,7 +505,7 @@ def locator_status_entry(
 ) -> tuple[dict[str, str], str | None]:
     locator, target = resolve_locator(root, raw_locator)
     if locator is None or target is None:
-        return carrier_entry("missing", "unknown", source), f"{source} is missing a valid locator"
+        return carrier_entry("missing", "unknown", source), locator_boundary_error(raw_locator, label=source)
     if not target.exists():
         return carrier_entry("missing", locator, source), f"{source} points to missing path `{locator}`"
     return carrier_entry("present", locator, source), None
@@ -520,7 +531,7 @@ def validate_repo_specific_requirement(
         missing_inputs.append(f"{prefix} enforcement must be `blocking` or `advisory`")
     locator, target = resolve_locator(root, entry.get("locator"))
     if locator is None or target is None:
-        missing_inputs.append(f"{prefix} locator must be a non-empty string")
+        missing_inputs.append(locator_boundary_error(entry.get("locator"), label=f"{prefix} locator"))
     elif not target.exists():
         missing_inputs.append(f"{prefix} locator points to missing path `{locator}`")
     return missing_inputs
@@ -542,7 +553,7 @@ def validate_specialized_gate(
             missing_inputs.append(f"{prefix} missing `{field}`")
     locator, target = resolve_locator(root, entry.get("locator"))
     if locator is None or target is None:
-        missing_inputs.append(f"{prefix} locator must be a non-empty string")
+        missing_inputs.append(locator_boundary_error(entry.get("locator"), label=f"{prefix} locator"))
     elif not target.exists():
         missing_inputs.append(f"{prefix} locator points to missing path `{locator}`")
     gate_type = entry.get("gate_type")
@@ -582,7 +593,7 @@ def validate_metadata_contract(
         for locator_field in ("applicability_locator", "authority_locator"):
             locator, target = resolve_locator(root, field.get(locator_field))
             if locator is None or target is None:
-                missing_inputs.append(f"{field_prefix} `{locator_field}` must be a non-empty string")
+                missing_inputs.append(locator_boundary_error(field.get(locator_field), label=f"{field_prefix} `{locator_field}`"))
             elif not target.exists():
                 missing_inputs.append(f"{field_prefix} `{locator_field}` points to missing path `{locator}`")
     return missing_inputs
@@ -616,7 +627,7 @@ def validate_context_schema(
             missing_inputs.append(f"{field_prefix} `required` must be a boolean")
         locator, target = resolve_locator(root, field.get("mapping_rule_locator"))
         if locator is None or target is None:
-            missing_inputs.append(f"{field_prefix} `mapping_rule_locator` must be a non-empty string")
+            missing_inputs.append(locator_boundary_error(field.get("mapping_rule_locator"), label=f"{field_prefix} `mapping_rule_locator`"))
         elif not target.exists():
             missing_inputs.append(f"{field_prefix} `mapping_rule_locator` points to missing path `{locator}`")
     return missing_inputs
@@ -648,7 +659,7 @@ def validate_repo_interop_collection_entry(
                 )
     locator, target = resolve_locator(root, entry.get("locator"))
     if locator is None or target is None:
-        missing_inputs.append(f"{prefix} locator must be a non-empty string")
+        missing_inputs.append(locator_boundary_error(entry.get("locator"), label=f"{prefix} locator"))
     elif not target.exists():
         missing_inputs.append(f"{prefix} locator points to missing path `{locator}`")
     return missing_inputs
@@ -670,7 +681,7 @@ def validate_shadow_surface(
     for locator_field in ("loom_locator", "repo_locator"):
         locator, target = resolve_locator(root, entry.get(locator_field))
         if locator is None or target is None:
-            missing_inputs.append(f"{prefix} `{locator_field}` must be a non-empty string")
+            missing_inputs.append(locator_boundary_error(entry.get(locator_field), label=f"{prefix} `{locator_field}`"))
         elif not target.exists():
             missing_inputs.append(f"{prefix} `{locator_field}` points to missing path `{locator}`")
     return missing_inputs
@@ -1089,7 +1100,8 @@ def detect_github_control_plane(root: Path) -> tuple[dict[str, Any], list[str]]:
         missing_inputs.append("github control plane: default branch is unavailable")
         return surface, missing_inputs
 
-    branch_payload, branch_errors = gh_json(root, ["api", f"repos/{owner}/{repo}/branches/{surface['default_branch']}"])
+    encoded_branch = quote(str(surface["default_branch"]), safe="")
+    branch_payload, branch_errors = gh_json(root, ["api", f"repos/{owner}/{repo}/branches/{encoded_branch}"])
     if branch_errors or branch_payload is None:
         missing_inputs.extend(f"github control plane: {message}" for message in branch_errors)
         return surface, missing_inputs