turnloop 0.1.7__tar.gz → 0.1.9__tar.gz

{turnloop-0.1.7 → turnloop-0.1.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: turnloop
-Version: 0.1.7
+Version: 0.1.9
 Summary: A local-first agentic coding harness: streaming tool loop, permission gating, context compaction, subagents, and any LLM provider.
 Project-URL: Homepage, https://github.com/Pranesh-2005/turnloop
 Author: Pranesh
@@ -49,7 +49,7 @@ tl experiment run smoke         # a measurement run, offline and free
 
 Four runtime dependencies: `textual`, `pydantic`, `httpx`, `pyyaml`. No vendor
 SDKs, no agent framework — the loop is the point, so the loop is written here.
-~20,000 lines of Python, 338 tests, no network in the default test run.
+~20,000 lines of Python, 346 tests, no network in the default test run.
 
 ---
 
@@ -117,7 +117,7 @@ point.
 Verify:
 
 ```bash
-tl --version                # turnloop 0.1.7
+tl --version                # turnloop 0.1.9
 tl doctor                   # every provider, key presence, shell, context budget
 ```
 
@@ -1023,7 +1023,7 @@ one-line edit in a CRLF checkout does not produce a whole-file diff.
 ## Testing
 
 ```bash
-pytest                    # 338 tests, no network
+pytest                    # 346 tests, no network
 ruff check turnloop
 mypy turnloop
 ```
@@ -1037,7 +1037,7 @@ mypy turnloop
 | `test_hooks_mcp_commands.py` | 28 | lifecycle hooks, MCP client, slash commands |
 | `test_tui.py` | 25 | Textual snapshots, `/config` and `/mcp add` driven through a real app |
 | `test_config.py` | 23 | layering, env overrides, presets, narrow-console guard |
-| `test_skills_install.py` | 19 | frontmatter validation, GitHub resolution, import subsets, drive-root refusal |
+| `test_skills_install.py` | 27 | frontmatter validation, GitHub resolution, path dedupe, EOF on every prompt, drive-root refusal |
 | `test_loop.py` | 23 | streaming, truncation, iteration cap |
 | `test_compaction.py` | 16 | three tiers, tool_use/tool_result invariant |
 | `test_configio.py` | 15 | minimal-diff writes, atomic save, secret-bearing MCP targets, the settings deny rules |
@@ -1092,11 +1092,19 @@ in the system prompt and load their body on demand, which on a 65k window is the
 difference between having skills and not.
 
 The system prompt also documents this layout to the model itself, as `CONFIG_LAYOUT`
-— 326 tokens, in the cacheable region, omitted from the `minimal` variant. Without it
+— 432 tokens, in the cacheable region, omitted from the `minimal` variant. Without it
 the model cannot configure the tool it is running inside: asked to add an MCP server
 it invented `.turnloop/turnloop.config.json`, and asked to install a skill it wrote to
 `examples/` — both real outputs from live runs. With it, both go to the right place
-first try. It includes the literal YAML frontmatter a skill needs, since a skill with
+first try.
+
+It also names `tl skills add` explicitly and tells the model *not* to run the install
+scripts skill repos publish for other agents. That paragraph was added after watching
+three separate sessions try `/plugin marketplace add` as a shell command, then
+`clawhub install`, then `git clone` plus `npm install` plus `npm test` — twenty-six
+messages ending in "the ponytail skill has been installed", when nothing had been put
+anywhere turnloop looks. The same request now costs 11,090 tokens and answers
+`tl skills add DietrichGebert/ponytail`. It includes the literal YAML frontmatter a skill needs, since a skill with
 markdown-bold frontmatter instead of YAML used to vanish with no diagnostic; `/skills`
 now also reports anything found on disk but rejected, with the reason and path — see
 [Bugs worth reading about](#bugs-worth-reading-about).

{turnloop-0.1.7 → turnloop-0.1.9}/README.md

@@ -20,7 +20,7 @@ tl experiment run smoke         # a measurement run, offline and free
 
 Four runtime dependencies: `textual`, `pydantic`, `httpx`, `pyyaml`. No vendor
 SDKs, no agent framework — the loop is the point, so the loop is written here.
-~20,000 lines of Python, 338 tests, no network in the default test run.
+~20,000 lines of Python, 346 tests, no network in the default test run.
 
 ---
 
@@ -88,7 +88,7 @@ point.
 Verify:
 
 ```bash
-tl --version                # turnloop 0.1.7
+tl --version                # turnloop 0.1.9
 tl doctor                   # every provider, key presence, shell, context budget
 ```
 
@@ -994,7 +994,7 @@ one-line edit in a CRLF checkout does not produce a whole-file diff.
 ## Testing
 
 ```bash
-pytest                    # 338 tests, no network
+pytest                    # 346 tests, no network
 ruff check turnloop
 mypy turnloop
 ```
@@ -1008,7 +1008,7 @@ mypy turnloop
 | `test_hooks_mcp_commands.py` | 28 | lifecycle hooks, MCP client, slash commands |
 | `test_tui.py` | 25 | Textual snapshots, `/config` and `/mcp add` driven through a real app |
 | `test_config.py` | 23 | layering, env overrides, presets, narrow-console guard |
-| `test_skills_install.py` | 19 | frontmatter validation, GitHub resolution, import subsets, drive-root refusal |
+| `test_skills_install.py` | 27 | frontmatter validation, GitHub resolution, path dedupe, EOF on every prompt, drive-root refusal |
 | `test_loop.py` | 23 | streaming, truncation, iteration cap |
 | `test_compaction.py` | 16 | three tiers, tool_use/tool_result invariant |
 | `test_configio.py` | 15 | minimal-diff writes, atomic save, secret-bearing MCP targets, the settings deny rules |
@@ -1063,11 +1063,19 @@ in the system prompt and load their body on demand, which on a 65k window is the
 difference between having skills and not.
 
 The system prompt also documents this layout to the model itself, as `CONFIG_LAYOUT`
-— 326 tokens, in the cacheable region, omitted from the `minimal` variant. Without it
+— 432 tokens, in the cacheable region, omitted from the `minimal` variant. Without it
 the model cannot configure the tool it is running inside: asked to add an MCP server
 it invented `.turnloop/turnloop.config.json`, and asked to install a skill it wrote to
 `examples/` — both real outputs from live runs. With it, both go to the right place
-first try. It includes the literal YAML frontmatter a skill needs, since a skill with
+first try.
+
+It also names `tl skills add` explicitly and tells the model *not* to run the install
+scripts skill repos publish for other agents. That paragraph was added after watching
+three separate sessions try `/plugin marketplace add` as a shell command, then
+`clawhub install`, then `git clone` plus `npm install` plus `npm test` — twenty-six
+messages ending in "the ponytail skill has been installed", when nothing had been put
+anywhere turnloop looks. The same request now costs 11,090 tokens and answers
+`tl skills add DietrichGebert/ponytail`. It includes the literal YAML frontmatter a skill needs, since a skill with
 markdown-bold frontmatter instead of YAML used to vanish with no diagnostic; `/skills`
 now also reports anything found on disk but rejected, with the reason and path — see
 [Bugs worth reading about](#bugs-worth-reading-about).

{turnloop-0.1.7 → turnloop-0.1.9}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "turnloop"
-version = "0.1.7"
+version = "0.1.9"
 description = "A local-first agentic coding harness: streaming tool loop, permission gating, context compaction, subagents, and any LLM provider."
 readme = "README.md"
 requires-python = ">=3.11"
@@ -54,6 +54,14 @@ Homepage = "https://github.com/Pranesh-2005/turnloop"
 [tool.hatch.build.targets.wheel]
 packages = ["turnloop"]
 
+# Without an explicit include, the sdist sweeps up whatever happens to be sitting
+# in the working tree. A stray `git clone` left behind by a failed skill install
+# put 157 of 317 entries — 4.2 MB of an unrelated repository — into the 0.1.8
+# sdist before this was pinned down. An allowlist fails closed: new junk is not
+# published, and a genuinely new top-level path has to be added here on purpose.
+[tool.hatch.build.targets.sdist]
+include = ["turnloop", "tests", "README.md", "pyproject.toml", "LICENSE"]
+
 [tool.ruff]
 line-length = 100
 target-version = "py311"

{turnloop-0.1.7 → turnloop-0.1.9}/tests/test_skills_install.py

@@ -8,17 +8,21 @@ the same technique httpx's own docs recommend for offline tests.
 
 from __future__ import annotations
 
+import argparse
 import json
 from pathlib import Path
 
 import httpx
 import pytest
 
+import turnloop.skills_install as skills_install
+from turnloop.cli import _cmd_skills_add, _cmd_skills_import, _cmd_skills_remove
 from turnloop.commands.loader import load_skills
 from turnloop.config import default_settings, load_settings
 from turnloop.errors import ConfigError
 from turnloop.skills_install import (
     SkillInstallError,
+    SkillSource,
     fetch_skill_sources,
     find_claude_code_candidates,
     import_selected,
@@ -332,3 +336,188 @@ def test_mark_import_asked_is_idempotent(tmp_path, monkeypatch, project):
 
     on_disk = json.loads(fake_user_path.read_text(encoding="utf-8"))
     assert on_disk == {"skills_import_asked": True}
+
+
+# --------------------------------------------------------------------------
+# a repo shipping the same skill under two paths must not collide silently
+# --------------------------------------------------------------------------
+
+
+def _ponytail_tree() -> dict:
+    """The real layout from the bug report: 6 skills, each under both
+    `.openclaw/skills/<name>/` (a different harness's convention) and the
+    repo's own `skills/<name>/` -- 12 paths, 6 distinct skills."""
+    names = ["ponytail-audit", "ponytail-debt", "ponytail-gain", "ponytail-help",
+             "ponytail-review", "ponytail"]
+    paths = [f".openclaw/skills/{n}/SKILL.md" for n in names]
+    paths += [f"skills/{n}/SKILL.md" for n in names]
+    return {"tree": [{"path": p, "type": "blob"} for p in paths]}
+
+
+async def test_fetch_repo_dedupes_the_same_skill_shipped_under_two_paths():
+    tree = _ponytail_tree()
+
+    async def handler(request: httpx.Request) -> httpx.Response:
+        url = str(request.url)
+        if "git/trees" in url:
+            return httpx.Response(200, json=tree)
+        if url.startswith("https://api.github.com/repos/o/r"):
+            return httpx.Response(200, json={"default_branch": "main"})
+        return httpx.Response(200, text=VALID_SKILL)
+
+    async with mock_client(handler) as client:
+        sources = await fetch_skill_sources("o/r", client)
+
+    names = [s.name for s in sources]
+    assert len(names) == len(set(names)) == 6  # 12 paths in, 6 unique targets out
+    # the shallower `skills/<name>/` copy wins over `.openclaw/skills/<name>/`
+    assert all("/skills/" in s.raw_url and "/.openclaw/" not in s.raw_url for s in sources)
+
+
+async def test_fetch_repo_raises_on_a_genuine_equal_depth_collision():
+    """Two paths at the same depth resolving to the same name is a real
+    ambiguity (which one is "the" skill?), not a canonical-copy pick -- must
+    be reported, never resolved by guessing."""
+    tree = {"tree": [
+        {"path": "docs/x/SKILL.md", "type": "blob"},
+        {"path": "examples/x/SKILL.md", "type": "blob"},
+    ]}
+
+    async def handler(request: httpx.Request) -> httpx.Response:
+        url = str(request.url)
+        if "git/trees" in url:
+            return httpx.Response(200, json=tree)
+        return httpx.Response(200, json={"default_branch": "main"})
+
+    async with mock_client(handler) as client:
+        with pytest.raises(SkillInstallError) as exc_info:
+            await fetch_skill_sources("o/r", client)
+
+    assert "docs/x/SKILL.md" in str(exc_info.value)
+    assert "examples/x/SKILL.md" in str(exc_info.value)
+
+
+def test_installing_the_deduped_set_never_writes_the_same_target_twice(project):
+    tree = _ponytail_tree()
+    paths = sorted(item["path"] for item in tree["tree"])
+    winners = skills_install._dedupe_skill_paths(paths)
+
+    assert len(winners) == 6
+    for path in winners:
+        name = skills_install._name_from_path(path)
+        content = f"---\nname: {name}\ndescription: a {name} skill\n---\nbody\n"
+        install_skill(content, False, project, name_hint=name)
+
+    loaded = load_skills(project)
+    assert len(loaded) == 6  # no target overwritten a second time within the run
+
+
+# --------------------------------------------------------------------------
+# --yes on a collection installs all of them without touching stdin
+# --------------------------------------------------------------------------
+
+
+def _no_input_allowed(monkeypatch):
+    """Fails the test immediately if any prompt reaches real `input()`."""
+
+    def _boom(*_args, **_kwargs):
+        raise AssertionError("input() must not be called")
+
+    monkeypatch.setattr("builtins.input", _boom)
+
+
+def test_yes_installs_every_source_in_a_collection_without_prompting(settings, monkeypatch):
+    _no_input_allowed(monkeypatch)
+    sources = [
+        SkillSource(name=n, raw_url=f"https://example/{n}/SKILL.md",
+                    content=f"---\nname: {n}\ndescription: skill {n}\n---\nbody\n")
+        for n in ("one", "two", "three")
+    ]
+
+    async def fake_fetch(_source, _client):
+        return sources
+
+    monkeypatch.setattr(skills_install, "fetch_skill_sources", fake_fetch)
+
+    args = argparse.Namespace(source="o/r", user=False, yes=True)
+    rc = _cmd_skills_add(settings, args, settings.project_root)
+
+    assert rc == 0
+    assert set(load_skills(settings.project_root)) == {"one", "two", "three"}
+
+
+# --------------------------------------------------------------------------
+# every prompt exits cleanly on EOF (closed/piped stdin) instead of raising
+# --------------------------------------------------------------------------
+
+
+def _raise_eof(monkeypatch):
+    def _boom(*_args, **_kwargs):
+        raise EOFError()
+
+    monkeypatch.setattr("builtins.input", _boom)
+
+
+def test_collection_selector_prompt_exits_cleanly_on_eof(settings, monkeypatch, capsys):
+    _raise_eof(monkeypatch)
+    sources = [
+        SkillSource(name=n, raw_url=f"https://example/{n}/SKILL.md",
+                    content=f"---\nname: {n}\ndescription: skill {n}\n---\nbody\n")
+        for n in ("one", "two")
+    ]
+
+    async def fake_fetch(_source, _client):
+        return sources
+
+    monkeypatch.setattr(skills_install, "fetch_skill_sources", fake_fetch)
+
+    args = argparse.Namespace(source="o/r", user=False, yes=False)
+    with pytest.raises(SystemExit) as exc_info:
+        _cmd_skills_add(settings, args, settings.project_root)
+
+    assert exc_info.value.code == 1
+    assert "no input available" in capsys.readouterr().err
+
+
+def test_single_skill_confirmation_prompt_exits_cleanly_on_eof(settings, monkeypatch, capsys):
+    _raise_eof(monkeypatch)
+    source = SkillSource(name="one", raw_url="https://example/one/SKILL.md", content=VALID_SKILL)
+
+    async def fake_fetch(_source, _client):
+        return [source]
+
+    monkeypatch.setattr(skills_install, "fetch_skill_sources", fake_fetch)
+
+    args = argparse.Namespace(source="o/r", user=False, yes=False)
+    with pytest.raises(SystemExit) as exc_info:
+        _cmd_skills_add(settings, args, settings.project_root)
+
+    assert exc_info.value.code == 1
+    assert "no input available" in capsys.readouterr().err
+
+
+def test_remove_confirmation_prompt_exits_cleanly_on_eof(settings, monkeypatch, capsys):
+    install_skill(VALID_SKILL, False, settings.project_root, name_hint="demo")
+    _raise_eof(monkeypatch)
+
+    args = argparse.Namespace(name="demo", user=False, yes=False)
+    with pytest.raises(SystemExit) as exc_info:
+        _cmd_skills_remove(settings, args)
+
+    assert exc_info.value.code == 1
+    assert "no input available" in capsys.readouterr().err
+
+
+def test_import_selector_prompt_exits_cleanly_on_eof(settings, monkeypatch, capsys, tmp_path):
+    claude_dir = tmp_path / "claude-skills"
+    _write_claude_skill(claude_dir, "not-yet")
+    monkeypatch.setattr("turnloop.skills_install.CLAUDE_CODE_SKILLS_DIR", claude_dir)
+    monkeypatch.setattr("turnloop.configio.user_settings_path", lambda: tmp_path / "home" / "settings.json")
+    _raise_eof(monkeypatch)
+
+    args = argparse.Namespace(user=False, all=False)
+    with pytest.raises(SystemExit) as exc_info:
+        _cmd_skills_import(settings, args, settings.project_root)
+
+    assert exc_info.value.code == 1
+    assert "no input available" in capsys.readouterr().err

{turnloop-0.1.7 → turnloop-0.1.9}/turnloop/__init__.py

@@ -1,3 +1,3 @@
 """turnloop — a local-first agentic coding harness."""
 
-__version__ = "0.1.7"
+__version__ = "0.1.9"

{turnloop-0.1.7 → turnloop-0.1.9}/turnloop/agent/system_prompt.py

@@ -114,6 +114,11 @@ Frontmatter is YAML, not markdown, and needs `description` or it is dropped \
   name: my-skill
   description: one line the model uses to decide when to load this
   ---
+  Installing one is the user's job, not yours: `tl skills add <owner/repo>` \
+fetches and validates a SKILL.md, and `tl skills import` adopts skills already \
+on the machine. Skill repos publish install scripts for other agents \
+(`/plugin ...`, `clawhub`, `npm install`) — none of those put anything where \
+turnloop looks, so never run them. Point the user at `tl skills add` instead.
 """
 
 PLAN_MODE = """\

{turnloop-0.1.7 → turnloop-0.1.9}/turnloop/cli.py

@@ -255,6 +255,22 @@ def _print_skill_target(settings: Settings, user_level: bool, cwd: Path) -> None
               f"current directory ({cwd}) -- run `tl config` to see why")
 
 
+def _prompt(text: str) -> str:
+    """`input()`, but closed/piped stdin exits cleanly instead of a traceback.
+
+    Every confirmation in the skills commands goes through this. Piping stdin
+    from `/dev/null` (or any non-interactive invocation -- CI, a script) hits
+    EOF the instant `input()` reads, which is a normal thing for a CLI to face
+    and not worth a stack trace over.
+    """
+    try:
+        return input(text)
+    except EOFError:
+        print("\nskills: no input available (stdin is closed) -- rerun with --yes "
+              "for non-interactive use", file=sys.stderr)
+        raise SystemExit(1) from None
+
+
 _SKILL_TRUST_NOTICE = (
     "Its body will be loaded into the model's context whenever the model decides "
     "it applies -- this is the same class of trust decision as adding an MCP "
@@ -291,19 +307,30 @@ def _cmd_skills_add(settings: Settings, args: argparse.Namespace, cwd: Path) ->
         print(f"{args.source} contains {len(sources)} skills:")
         for i, s in enumerate(sources, 1):
             print(f"  {i}. {s.name}")
-        choice = input("install which? (numbers comma-separated, or 'all'): ").strip()
-        if choice.lower() == "all":
+        if args.yes:
+            # `--yes` means "don't make me answer prompts", and the collection
+            # selector is a prompt like any other -- treating it differently would
+            # mean `--yes` still hangs (now fixed to error) waiting on stdin that
+            # was never going to arrive in a script/CI invocation. "all" is also
+            # the reading that makes `--yes` actually do what it says on the tin;
+            # each SKILL.md still goes through validate_skill_content below, so a
+            # broken one is skipped rather than silently written.
+            print(f"--yes: installing all {len(sources)}")
             chosen = sources
         else:
-            try:
-                picked = {int(x) for x in choice.split(",") if x.strip()}
-            except ValueError:
-                print("skills add: not a valid selection", file=sys.stderr)
-                return 2
-            chosen = [s for i, s in enumerate(sources, 1) if i in picked]
-        if not chosen:
-            print("nothing selected")
-            return 0
+            choice = _prompt("install which? (numbers comma-separated, or 'all'): ").strip()
+            if choice.lower() == "all":
+                chosen = sources
+            else:
+                try:
+                    picked = {int(x) for x in choice.split(",") if x.strip()}
+                except ValueError:
+                    print("skills add: not a valid selection", file=sys.stderr)
+                    return 2
+                chosen = [s for i, s in enumerate(sources, 1) if i in picked]
+            if not chosen:
+                print("nothing selected")
+                return 0
     else:
         chosen = sources
 
@@ -320,7 +347,7 @@ def _cmd_skills_add(settings: Settings, args: argparse.Namespace, cwd: Path) ->
         print(f"description: {description}")
         print(_SKILL_TRUST_NOTICE)
         if not args.yes:
-            if input("install this skill? [y/N] ").strip().lower() not in ("y", "yes"):
+            if _prompt("install this skill? [y/N] ").strip().lower() not in ("y", "yes"):
                 print(f"skipped {name}")
                 continue
 
@@ -353,7 +380,7 @@ def _cmd_skills_remove(settings: Settings, args: argparse.Namespace) -> int:
 
     scope = "user" if args.user else "project"
     if not args.yes:
-        confirm = input(f"remove skill '{args.name}' ({scope})? [y/N] ").strip().lower()
+        confirm = _prompt(f"remove skill '{args.name}' ({scope})? [y/N] ").strip().lower()
         if confirm not in ("y", "yes"):
             print("cancelled")
             return 0
@@ -389,7 +416,7 @@ def _cmd_skills_import(settings: Settings, args: argparse.Namespace, cwd: Path)
     if args.all:
         chosen = candidates
     else:
-        choice = input("import which? (numbers comma-separated, 'all', or blank to skip): ").strip()
+        choice = _prompt("import which? (numbers comma-separated, 'all', or blank to skip): ").strip()
         if not choice:
             print("nothing imported. Run `tl skills import` again anytime.")
             return 0

{turnloop-0.1.7 → turnloop-0.1.9}/turnloop/skills_install.py

@@ -95,6 +95,7 @@ async def fetch_skill_sources(source: str, client: httpx.AsyncClient) -> list[Sk
     paths = await _list_skill_md_paths(client, owner, name, branch)
     if not paths:
         raise SkillInstallError(f"no SKILL.md found in {owner}/{name}")
+    paths = _dedupe_skill_paths(paths)  # before fetching -- no point downloading a copy we'll discard
     sources = []
     for path in paths:
         raw_url = f"https://raw.githubusercontent.com/{owner}/{name}/{branch}/{path}"
@@ -140,7 +141,15 @@ async def _default_branch(client: httpx.AsyncClient, owner: str, name: str) -> s
 async def _list_skill_md_paths(
     client: httpx.AsyncClient, owner: str, name: str, branch: str
 ) -> list[str]:
-    """Every `SKILL.md` in the repo -- root or nested one directory deep, both."""
+    """Every `SKILL.md` in the repo, at any depth.
+
+    `recursive=1` on the git trees API walks the whole tree, not just root and
+    one level down -- that's how a real repo's `.openclaw/skills/<n>/SKILL.md`
+    (three levels deep) turns up alongside `skills/<n>/SKILL.md`. The old
+    docstring here claimed "root or nested one directory deep, both", which
+    was never what the code did; fixed to describe the actual (and wanted)
+    behavior instead of narrowing the code to match a wrong claim.
+    """
     response = await client.get(
         f"https://api.github.com/repos/{owner}/{name}/git/trees/{branch}",
         params={"recursive": "1"},
@@ -156,6 +165,41 @@ async def _list_skill_md_paths(
     )
 
 
+def _dedupe_skill_paths(paths: list[str]) -> list[str]:
+    """One winning path per install name -- never two paths writing the same target.
+
+    A repo can ship the same skill twice: once at `skills/<name>/SKILL.md` for
+    itself, once at `.openclaw/skills/<name>/SKILL.md` (or any other harness's
+    dot-directory) so that harness's own loader picks it up too. Both resolve
+    to install name `<name>` (`_name_from_path` only looks at the parent dir),
+    so installing "all" would write the same target twice, second write
+    silently winning with no sign a collision happened.
+
+    Shallower path wins: fewer directory components before `SKILL.md` reads as
+    "closer to the repo's own root", which is a reasonable proxy for "the
+    canonical copy" for any repo, not just one with a `.openclaw/` layout. A
+    tie at equal depth is a genuine ambiguity -- e.g. `docs/x/SKILL.md` vs
+    `examples/x/SKILL.md` -- and gets refused rather than resolved by
+    guessing; the caller can still install either directly by raw URL.
+    """
+    by_name: dict[str, list[str]] = {}
+    for p in paths:
+        by_name.setdefault(_name_from_path(p), []).append(p)
+
+    winners = []
+    for name, candidates in by_name.items():
+        shallowest = min(p.count("/") for p in candidates)
+        tied = [p for p in candidates if p.count("/") == shallowest]
+        if len(tied) > 1:
+            raise SkillInstallError(
+                f"'{name}' has {len(tied)} equally-plausible SKILL.md paths and "
+                f"cannot be resolved automatically: {', '.join(sorted(tied))}. "
+                "Install one directly by its raw URL instead."
+            )
+        winners.append(tied[0])
+    return sorted(winners)
+
+
 def _name_from_path(path_or_url: str) -> str:
     """The install name: the SKILL.md's parent directory, or 'skill' at repo root."""
     path = urlparse(path_or_url).path if "://" in path_or_url else path_or_url

turnloop-0.1.7/.github/workflows/ci.yml

@@ -1,36 +0,0 @@
-name: ci
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-
-jobs:
-  test:
-    strategy:
-      fail-fast: false
-      matrix:
-        # Windows is not optional here: shell resolution and process-tree kill are
-        # platform-specific and are exactly where this project's bugs live.
-        os: [ubuntu-latest, windows-latest]
-        python: ["3.11", "3.13"]
-    runs-on: ${{ matrix.os }}
-    steps:
-      - uses: actions/checkout@v5
-
-      - uses: actions/setup-python@v6
-        with:
-          python-version: ${{ matrix.python }}
-
-      - run: pip install -e ".[dev]"
-
-      - name: Tests
-        # Network is blocked at the transport layer by conftest, so `not live` is
-        # belt and braces rather than the only guard.
-        run: pytest -m "not live"
-
-      - name: Lint
-        run: ruff check turnloop tests
-
-      - name: Types
-        run: mypy turnloop

turnloop-0.1.7/.turnloop/.gitignore

@@ -1,2 +0,0 @@
-sessions/
-settings.local.json

turnloop-0.1.7/.turnloop/settings.local.json

@@ -1,3 +0,0 @@
-{
-  "provider": "blaxel"
-}