turnloop 0.1.8__tar.gz → 0.1.9__tar.gz

{turnloop-0.1.8 → turnloop-0.1.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: turnloop
-Version: 0.1.8
+Version: 0.1.9
 Summary: A local-first agentic coding harness: streaming tool loop, permission gating, context compaction, subagents, and any LLM provider.
 Project-URL: Homepage, https://github.com/Pranesh-2005/turnloop
 Author: Pranesh
@@ -117,7 +117,7 @@ point.
 Verify:
 
 ```bash
-tl --version                # turnloop 0.1.8
+tl --version                # turnloop 0.1.9
 tl doctor                   # every provider, key presence, shell, context budget
 ```
 
@@ -1092,11 +1092,19 @@ in the system prompt and load their body on demand, which on a 65k window is the
 difference between having skills and not.
 
 The system prompt also documents this layout to the model itself, as `CONFIG_LAYOUT`
-— 326 tokens, in the cacheable region, omitted from the `minimal` variant. Without it
+— 432 tokens, in the cacheable region, omitted from the `minimal` variant. Without it
 the model cannot configure the tool it is running inside: asked to add an MCP server
 it invented `.turnloop/turnloop.config.json`, and asked to install a skill it wrote to
 `examples/` — both real outputs from live runs. With it, both go to the right place
-first try. It includes the literal YAML frontmatter a skill needs, since a skill with
+first try.
+
+It also names `tl skills add` explicitly and tells the model *not* to run the install
+scripts skill repos publish for other agents. That paragraph was added after watching
+three separate sessions try `/plugin marketplace add` as a shell command, then
+`clawhub install`, then `git clone` plus `npm install` plus `npm test` — twenty-six
+messages ending in "the ponytail skill has been installed", when nothing had been put
+anywhere turnloop looks. The same request now costs 11,090 tokens and answers
+`tl skills add DietrichGebert/ponytail`. It includes the literal YAML frontmatter a skill needs, since a skill with
 markdown-bold frontmatter instead of YAML used to vanish with no diagnostic; `/skills`
 now also reports anything found on disk but rejected, with the reason and path — see
 [Bugs worth reading about](#bugs-worth-reading-about).

{turnloop-0.1.8 → turnloop-0.1.9}/README.md

@@ -88,7 +88,7 @@ point.
 Verify:
 
 ```bash
-tl --version                # turnloop 0.1.8
+tl --version                # turnloop 0.1.9
 tl doctor                   # every provider, key presence, shell, context budget
 ```
 
@@ -1063,11 +1063,19 @@ in the system prompt and load their body on demand, which on a 65k window is the
 difference between having skills and not.
 
 The system prompt also documents this layout to the model itself, as `CONFIG_LAYOUT`
-— 326 tokens, in the cacheable region, omitted from the `minimal` variant. Without it
+— 432 tokens, in the cacheable region, omitted from the `minimal` variant. Without it
 the model cannot configure the tool it is running inside: asked to add an MCP server
 it invented `.turnloop/turnloop.config.json`, and asked to install a skill it wrote to
 `examples/` — both real outputs from live runs. With it, both go to the right place
-first try. It includes the literal YAML frontmatter a skill needs, since a skill with
+first try.
+
+It also names `tl skills add` explicitly and tells the model *not* to run the install
+scripts skill repos publish for other agents. That paragraph was added after watching
+three separate sessions try `/plugin marketplace add` as a shell command, then
+`clawhub install`, then `git clone` plus `npm install` plus `npm test` — twenty-six
+messages ending in "the ponytail skill has been installed", when nothing had been put
+anywhere turnloop looks. The same request now costs 11,090 tokens and answers
+`tl skills add DietrichGebert/ponytail`. It includes the literal YAML frontmatter a skill needs, since a skill with
 markdown-bold frontmatter instead of YAML used to vanish with no diagnostic; `/skills`
 now also reports anything found on disk but rejected, with the reason and path — see
 [Bugs worth reading about](#bugs-worth-reading-about).

{turnloop-0.1.8 → turnloop-0.1.9}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "turnloop"
-version = "0.1.8"
+version = "0.1.9"
 description = "A local-first agentic coding harness: streaming tool loop, permission gating, context compaction, subagents, and any LLM provider."
 readme = "README.md"
 requires-python = ">=3.11"
@@ -54,6 +54,14 @@ Homepage = "https://github.com/Pranesh-2005/turnloop"
 [tool.hatch.build.targets.wheel]
 packages = ["turnloop"]
 
+# Without an explicit include, the sdist sweeps up whatever happens to be sitting
+# in the working tree. A stray `git clone` left behind by a failed skill install
+# put 157 of 317 entries — 4.2 MB of an unrelated repository — into the 0.1.8
+# sdist before this was pinned down. An allowlist fails closed: new junk is not
+# published, and a genuinely new top-level path has to be added here on purpose.
+[tool.hatch.build.targets.sdist]
+include = ["turnloop", "tests", "README.md", "pyproject.toml", "LICENSE"]
+
 [tool.ruff]
 line-length = 100
 target-version = "py311"

{turnloop-0.1.8 → turnloop-0.1.9}/turnloop/__init__.py

@@ -1,3 +1,3 @@
 """turnloop — a local-first agentic coding harness."""
 
-__version__ = "0.1.8"
+__version__ = "0.1.9"

{turnloop-0.1.8 → turnloop-0.1.9}/turnloop/agent/system_prompt.py

@@ -114,6 +114,11 @@ Frontmatter is YAML, not markdown, and needs `description` or it is dropped \
   name: my-skill
   description: one line the model uses to decide when to load this
   ---
+  Installing one is the user's job, not yours: `tl skills add <owner/repo>` \
+fetches and validates a SKILL.md, and `tl skills import` adopts skills already \
+on the machine. Skill repos publish install scripts for other agents \
+(`/plugin ...`, `clawhub`, `npm install`) — none of those put anything where \
+turnloop looks, so never run them. Point the user at `tl skills add` instead.
 """
 
 PLAN_MODE = """\

turnloop-0.1.8/.github/workflows/ci.yml

@@ -1,36 +0,0 @@
-name: ci
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-
-jobs:
-  test:
-    strategy:
-      fail-fast: false
-      matrix:
-        # Windows is not optional here: shell resolution and process-tree kill are
-        # platform-specific and are exactly where this project's bugs live.
-        os: [ubuntu-latest, windows-latest]
-        python: ["3.11", "3.13"]
-    runs-on: ${{ matrix.os }}
-    steps:
-      - uses: actions/checkout@v5
-
-      - uses: actions/setup-python@v6
-        with:
-          python-version: ${{ matrix.python }}
-
-      - run: pip install -e ".[dev]"
-
-      - name: Tests
-        # Network is blocked at the transport layer by conftest, so `not live` is
-        # belt and braces rather than the only guard.
-        run: pytest -m "not live"
-
-      - name: Lint
-        run: ruff check turnloop tests
-
-      - name: Types
-        run: mypy turnloop

turnloop-0.1.8/.turnloop/.gitignore

@@ -1,2 +0,0 @@
-sessions/
-settings.local.json

turnloop-0.1.8/.turnloop/settings.local.json

@@ -1,3 +0,0 @@
-{
-  "provider": "blaxel"
-}