@ssheleg/sheleg-dev 0.11.0 → 0.11.1

package/CHANGELOG.md

@@ -4,6 +4,48 @@ All notable changes to this project are documented here.
 Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 Versioning: [SemVer](https://semver.org/spec/v2.0.0.html).
 
+## v0.11.1 — the evals stop being a plan, and the last tails get their receipts
+
+The 2026-08-29 skill audit left four tails (DEV-06 through DEV-08, DEV-10), and the
+eval suite's own RESULTS.md opened with "authored, schema-validated, never executed
+against a model". This release closes all four; that sentence is replaced by two dated
+model runs and the method that produced them.
+
+- **The behavioral evals cover all seven skills and carry dated runs** (DEV-10, board
+  B-103). Three scenarios are authored for the skills that had none — `crypto-payments`
+  (crediting under hostile deliveries), `error-tracking` (scrubbing layers and release
+  parity), `frontend-performance` (vitals moved and proven) — bringing `scenarios.json`
+  to six, green under `evals_validate.py` with the planted-defect self-test still
+  caught. Then the whole suite was executed on 2026-08-31: 14 trigger queries × 3 fresh
+  subagent sessions × 2 models (haiku, sonnet — 84 blind probes), plus all six
+  scenarios' expected-behavior lines scored against fresh sonnet implementation designs.
+  Haiku: train 23/24, validation 15/18. Sonnet: train 23/24, validation 16/18; scenario
+  lines 23/24 (s01's design named no refund-path test). Two findings are recorded
+  rather than tuned away: "Explain what LCP means" (q13, a negative case) pulls
+  `frontend-performance` in 5 of 6 runs across both models, and one sonnet run routed
+  the crypto implementation query to `task-pipeline` — coexistence changes routing,
+  exactly as the eval README warns. Method and its limits: `test/evals/RESULTS.md`.
+- **`ad-tracking`'s last two undated vendor facts were re-verified, and one was stale**
+  (DEV-06, B-104). The Enhanced Conversions step said `Tools → Conversions → …` — the
+  pre-redesign console path; checked 2026-08-31 against
+  `support.google.com/google-ads/answer/13258081`, the live path is **Goals →
+  Conversions → Settings → Enhanced conversions**, and the step now states it with its
+  date. The `_gcl_aw` claim was true but incomplete: the cookie's ~90-day default life
+  and the Safari ITP cap (JS-set cookies live 7 days, 24 hours after a link-decorated
+  navigation — which a gclid landing is) now sit beside the redirect-survival claim,
+  dated. Body ~4726 tokens of the 4750 house working limit.
+- **`google-signin` stops pointing installers at a private repository** (DEV-07,
+  B-102). The third sentence a reader met cited `web/server.py:1657` in the Prowl repo
+  as the live reference implementation — an address no installer can resolve (M-07).
+  The shipped `references/full-guide.md` FastAPI + JS skeleton is the reference
+  implementation, and the sentence now says so.
+- **`google-auth` states the major its own examples require** (DEV-08, B-101). The ADC
+  and JWT examples call `client.fetch()` while `npm install google-auth-library` pinned
+  nothing, so a reader on 9.x copied a method their client does not have. Checked
+  2026-08-31 against the library's CHANGELOG: the fetch-compatible API landed in
+  **10.1.0** (2025-06-12, PR #1939), `client.request()` is the 9.x form and survives in
+  the current 11.x. The install block now carries the floor, the fallback and the date.
+
 ## v0.11.0 — a trigger literal gets one home, and four facts get their dates
 
 The 2026-08-29 skill audit found the pack's two Google skills advertising the same

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ssheleg/sheleg-dev",
-  "version": "0.11.0",
+  "version": "0.11.1",
   "description": "Seven integration skills for the layer a product reaches once it has users: Stripe subscription billing and cancellation retention, crypto payments, ad and conversion tracking under Consent Mode v2, Google sign-in and the wider Google auth surface, error tracking, and Core Web Vitals. This package is the installer CLI.",
   "bin": {
     "sheleg-dev": "bin/sheleg-dev.js"

package/plugins/sheleg-dev/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "sheleg-dev",
   "displayName": "Sheleg Dev",
   "description": "The integration layer a product needs once it has users: Stripe subscription billing reconciled into your own database, crypto payments that survive over-payment and duplicate webhooks, ad and conversion tracking under Consent Mode v2, Google sign-in with the account-linking guards, the wider Google auth surface, and Core Web Vitals work that moves the score, and Sentry error tracking wired so it does not forward your own credentials to a third party and so a stack trace names the commit that caused it.",
-  "version": "0.11.0",
+  "version": "0.11.1",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/sheleg-dev/skills/ad-tracking/SKILL.md

@@ -180,7 +180,10 @@ gtag('set', 'user_data', {
 });
 ```
 
-3. Enable in Google Ads console: Tools → Conversions → Enhanced conversions → Turn on
+3. Enable in the Google Ads console: **Goals → Conversions → Settings →
+   Enhanced conversions → "Turn on enhanced conversions"** (checked 2026-08-31
+   against `support.google.com/google-ads/answer/13258081`; the old
+   Tools → Conversions path is gone from the redesigned UI)
 
 ### user_id (Cross-Device Tracking)
 
@@ -195,7 +198,11 @@ gtag('config', 'G-XXXXXXXXXX', {
 
 ### gclid Preservation Through External Redirects
 
-The `gclid` from Google Ads auto-tagging is stored in the `_gcl_aw` first-party cookie. This cookie persists across external redirects (e.g. Stripe Checkout → return URL) because it's set on your domain. No additional code needed.
+The `gclid` from Google Ads auto-tagging is stored in the `_gcl_aw` first-party
+cookie (~90-day default life). It survives external redirects (Stripe Checkout →
+return URL) because only expiry ends a cookie on your own domain — no extra code.
+Checked 2026-08-31; the caveat is Safari, where ITP caps JS-set cookies at 7
+days — 24 hours after a link-decorated navigation, which a gclid landing is.
 
 ### Google Ads console setup
 

package/plugins/sheleg-dev/skills/google-auth/SKILL.md

@@ -27,6 +27,11 @@ npm install google-auth-library
 npm install googleapis
 ```
 
+The `client.fetch()` calls below require google-auth-library **≥ 10.1.0** (the
+fetch-compatible API landed in 10.1.0, 2025-06-12); on 9.x use
+`client.request()` with the same arguments. Checked 2026-08-31: latest is 11.x
+and keeps both methods.
+
 ### Python
 
 - `google-auth` — core auth library (google.oauth2, google.auth, credentials, transport)

package/plugins/sheleg-dev/skills/google-signin/SKILL.md

@@ -17,9 +17,8 @@ description: >-
 Condensed operating instructions. Full narrative guide with diagrams, token
 anatomy, troubleshooting table, and a copy-paste FastAPI + JS skeleton:
 [references/full-guide.md](references/full-guide.md) — read it when
-implementing from scratch. A live reference implementation exists in the
-Prowl repo (`0xDEV`): `web/auth.py`, `web/server.py:1657`
-(`/api/auth/google`), `web/static/js/app.js:16-110`.
+implementing from scratch; its FastAPI + JS skeleton is the reference
+implementation this skill ships.
 
 ## Pick the right flow first