@ssheleg/sheleg-dev 0.13.4 → 0.15.0

package/CHANGELOG.md

@@ -1,3 +1,40 @@
+## v0.15.0: short router descriptions
+
+- Every skill's front-matter `description` is now a router, not a manual: one
+  "Use when" sentence, a "Not for" boundary naming the sibling skill, the opt-out
+  phrase (no wiring, без обвязки) and a short English and Russian trigger list.
+  Lengths before and after: stripe-billing 965 to 459, error-tracking 962 to 395,
+  frontend-performance 885 to 412, crypto-payments 884 to 398, ad-tracking 859 to 408,
+  google-signin 821 to 386, google-auth 798 to 417 (6,174 to 2,875 chars in total).
+- Why: Claude Code shares about 30,000 chars of skill listing across every installed
+  skill. Measured on 2026-10-20, the operator's listing held 29,995 chars for 134 skills
+  and 81 of them showed no description. Plugin skills cannot be hidden, so description
+  length is the only lever.
+- Every trigger phrase removed from a description moved verbatim into a new
+  `## Triggers` section at the end of that skill's body, so the family's routing hook
+  still finds each of its words in the skill's text.
+- `test/validate.py` refuses a description over 500 chars (the family cap; the
+  standard's 1024 stays the hard limit). The CI plant that pads crypto-payments by
+  320 chars now trips this cap.
+- `docs/evals/stripe-billing.md` restates the recomputed body budget (4603 tokens,
+  403 lines).
+
+## v0.14.0 — frontend performance is tested in WebKit (Safari) first
+
+- `frontend-performance/SKILL.md` gains *Test browser — WebKit (Safari) first*:
+  Safari through `safaridriver`, Playwright `webkit` (`--browser webkit`,
+  `npx playwright install webkit`), Safari Web Inspector's Timelines, and
+  `open -a Safari <url>` on macOS rather than the system default browser.
+- Lighthouse, PageSpeed Insights, CrUX, CDP traces and the chrome-devtools MCP stay
+  as the stated Chromium exception (Chromium by definition): Chrome Dev, a
+  temporary profile, every started process closed. A page checked only in Chromium
+  is reported as exactly that; a Lighthouse score is not a cross-browser verdict.
+- The Measure and Validate steps run the WebKit pass too; *Degradation* names the
+  WebKit channels; the contrast check in `references/accessibility-perf.md` starts
+  in Safari Web Inspector.
+- New regression `test/audit_regressions/safari-first.py` with drop mutations. Text
+  integrity only; no hook or script behaviour changed.
+
 ## v0.13.4 — FW03 credential boundaries
 
 - Supply a copyable, locally tested Stripe mode assertion before client construction.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ssheleg/sheleg-dev",
-  "version": "0.13.4",
+  "version": "0.15.0",
   "description": "Seven integration skills for the layer a product reaches once it has users: Stripe subscription billing and cancellation retention, crypto payments, ad and conversion tracking under Consent Mode v2, Google sign-in and the wider Google auth surface, error tracking, and Core Web Vitals. This package is the installer CLI.",
   "bin": {
     "sheleg-dev": "bin/sheleg-dev.js"

package/plugins/sheleg-dev/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "sheleg-dev",
   "displayName": "Sheleg Dev",
   "description": "The integration layer a product needs once it has users: Stripe subscription billing reconciled into your own database, crypto payments that survive over-payment and duplicate webhooks, ad and conversion tracking under Consent Mode v2, Google sign-in with the account-linking guards, the wider Google auth surface, and Core Web Vitals work that moves the score, and Sentry error tracking wired so it does not forward your own credentials to a third party and so a stack trace names the commit that caused it.",
-  "version": "0.13.4",
+  "version": "0.15.0",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/sheleg-dev/skills/ad-tracking/SKILL.md

@@ -1,16 +1,11 @@
 ---
 name: ad-tracking
 description: >-
-  Use when setting up or modifying ad pixel integration, conversion tracking, consent
-  management, purchase event tracking, retargeting audiences, or auditing an existing
-  advertising analytics stack. Covers Google Analytics 4, Google Ads, Meta (Facebook) Pixel and
-  LinkedIn Insight Tag in web applications: Consent Mode v2, standard events, e-commerce
-  tracking, advanced matching, Enhanced Conversions, CSP configuration, user identification,
-  cross-device tracking, and GDPR/DMA compliance. Triggers - "ad tracking", "conversion
-  tracking", "meta pixel", "fbq", "google ads", "GA4", "gtag", "consent mode", "cookie consent",
-  "enhanced conversions", "retargeting", "purchase event", "CAPI", "gclid", "UTM",
-  "attribution", "отслеживание конверсий", "пиксель Meta", "согласие на куки", "ретаргетинг",
-  "аналитика рекламы". Not for running the ad campaigns themselves.
+  Use when wiring or auditing ad pixels and conversion tracking on the web: GA4, Google Ads,
+  Meta Pixel and CAPI, LinkedIn Insight Tag, under Consent Mode v2 and GDPR/DMA. Not for
+  running the campaigns, or the charge itself (stripe-billing). Opt out: no wiring, без
+  обвязки. Triggers - "conversion tracking", "meta pixel", "consent mode", "GA4", "CAPI",
+  "отслеживание конверсий", "пиксель Meta", "ретаргетинг".
 license: MIT
 ---
 
@@ -425,3 +420,9 @@ and what to do about it — see the `frontend-performance` skill in this pack.
 - **No network, or the ad platform's API unreachable**: server-side events cannot be
   verified end to end. Say the dedup check did not run rather than reporting it held;
   a browser pixel firing proves the browser, never the conversion.
+
+## Triggers
+
+More phrases that route here: "ad tracking", "fbq", "google ads", "gtag", "cookie consent",
+"enhanced conversions", "retargeting", "purchase event", "gclid", "UTM", "attribution",
+"согласие на куки", "аналитика рекламы".

package/plugins/sheleg-dev/skills/crypto-payments/SKILL.md

@@ -1,16 +1,11 @@
 ---
 name: crypto-payments
 description: >-
-  Use when adding or auditing crypto checkout, crypto top-up, or payment webhooks — where a
-  payer sends the wrong amount, a webhook arrives more than once, and the rate moves between
-  quote and transfer. Covers invoice lifecycle and status mapping, webhook signature
-  verification and the JSON-escaping trap, idempotent processing, IP allowlisting behind a
-  proxy, CSRF exemption for callback routes, the conversion buffer, reconciliation fields,
-  credit waterfalls, refund and AML-hold states, local development with a tunnel and signed mock
-  callbacks, a test matrix and a security checklist. Triggers - "crypto payment", "crypto
-  checkout", "pay with crypto", "USDT payment", "TRC20", "payment webhook", "IPN", "webhook
-  signature", "underpayment", "Heleket", "NOWPayments", "приём криптоплатежей", "оплата
-  криптой", "вебхук платежа", "недоплата". Not for card billing — use stripe-billing.
+  Use when adding or auditing crypto checkout, crypto top-up or payment webhooks: invoice
+  states, signed callbacks, idempotent processing, underpayment and rate drift. Not for card
+  billing (stripe-billing). Opt out: no wiring, без обвязки. Triggers - "crypto payment",
+  "USDT payment", "payment webhook", "webhook signature", "underpayment", "приём
+  криптоплатежей", "оплата криптой", "вебхук платежа".
 license: MIT
 ---
 
@@ -414,3 +409,8 @@ a green suite, each with the defect it catches:
   half of this skill. Say the check did not run rather than reporting the invariant as
   held — an unrun check and a passing one are indistinguishable from the exit code
   nobody looked at.
+
+## Triggers
+
+More phrases that route here: "crypto checkout", "pay with crypto", "TRC20", "IPN",
+"Heleket", "NOWPayments", "недоплата".

package/plugins/sheleg-dev/skills/error-tracking/SKILL.md

@@ -1,17 +1,11 @@
 ---
 name: error-tracking
 description: >-
-  Use when wiring error tracking into a product — adding Sentry to a service, deciding what a
-  DSN is and where it may live, keeping secrets out of events before they reach a third party,
-  tying releases to commits so a stack trace names the change that caused it, or judging whether
-  a green health check means anything. Covers the Sentry SDK options that matter for a backend,
-  the two different tools both called sentry, the auth-token taxonomy and which kind can create
-  a project, and the MCP server with the config channel it belongs in. Triggers - "add Sentry",
-  "set up error tracking", "SENTRY_DSN", "sentry-cli", "sentry mcp", "scrub secrets from
-  errors", "release tracking", "suspect commits", "why is Sentry empty", "подключить Sentry",
-  "трекинг ошибок", "секреты в Sentry", "релизы в Sentry", "наблюдаемость". NOT for judging an
-  agent's trajectory (agent-evals), triaging tickets in a tracker (your tracker's own triage
-  skill), or choosing an uptime vendor.
+  Use when wiring error tracking into a service: the Sentry SDK, where a DSN may live,
+  scrubbing secrets out of events, and tying releases to commits. Not for judging an agent's
+  trajectory (agent-evals) or choosing an uptime vendor. Opt out: no wiring, без обвязки.
+  Triggers - "add Sentry", "SENTRY_DSN", "sentry-cli", "release tracking", "подключить
+  Sentry", "трекинг ошибок", "секреты в Sentry".
 license: MIT
 ---
 
@@ -285,3 +279,8 @@ Two claims worth re-measuring rather than trusting from this page, because both
 are version-dependent: the default denylist contents, and whether the SDK has
 started scrubbing values. `references/scrubbing.md` carries the command for
 each.
+
+## Triggers
+
+More phrases that route here: "set up error tracking", "sentry mcp", "scrub secrets from
+errors", "suspect commits", "why is Sentry empty", "релизы в Sentry", "наблюдаемость".

package/plugins/sheleg-dev/skills/frontend-performance/SKILL.md

@@ -1,16 +1,11 @@
 ---
 name: frontend-performance
 description: >-
-  Use when building or auditing web pages for performance — running PageSpeed Insights,
-  optimizing Lighthouse scores, fixing render-blocking resources, reducing bundle size,
-  improving load times, or diagnosing slow page rendering. Covers Core Web Vitals (LCP, INP,
-  CLS) and the Lighthouse diagnostics beside them (FCP, TBT, Speed Index), font loading strategies, CSS animation compositing, JavaScript
-  bundle optimization, cache headers, code splitting, Content Security Policy, image
-  optimization, and the contrast and heading issues that move a Lighthouse score. Triggers -
-  "performance audit", "PageSpeed", "Lighthouse", "Core Web Vitals", "LCP", "CLS", "INP",
-  "render-blocking", "bundle size", "code splitting", "lazy loading", "cache headers",
-  "performance budget", "ускорить сайт", "медленно грузится", "оптимизация скорости", "вес
-  бандла". Not for visual design or conversion work.
+  Use when building or auditing web pages for speed: Core Web Vitals (LCP, INP, CLS),
+  Lighthouse and PageSpeed scores, render-blocking resources, bundle size, fonts and
+  caching. Not for visual design (sheleg-design) or conversion work. Opt out: no wiring, без
+  обвязки. Triggers - "PageSpeed", "Lighthouse", "Core Web Vitals", "bundle size",
+  "performance budget", "ускорить сайт", "медленно грузится", "вес бандла".
 license: MIT
 ---
 
@@ -20,11 +15,33 @@ Optimize frontend applications for maximum Lighthouse scores and real-user perfo
 
 ## Audit Workflow
 
-1. **Measure** -- Run PageSpeed Insights or Lighthouse. Record scores and failing audits.
+1. **Measure** -- Run PageSpeed Insights or Lighthouse (Chromium) and load the same scenario in WebKit first (see *Test browser* below). Record scores, failing audits and the engine of each number.
 2. **Diagnose** -- Map each failing audit to a specific code-level cause (see checklist below).
 3. **Prioritize** -- Fix by impact: P0 blocks rendering, P1 hurts metrics, P2 is informational.
 4. **Implement** -- Apply fixes per the reference guides.
-5. **Validate** -- `next build` (or framework equivalent) + re-run Lighthouse. Verify no regressions.
+5. **Validate** -- `next build` (or framework equivalent) + re-run Lighthouse and the WebKit run. Verify no regressions in either engine.
+
+## Test browser — WebKit (Safari) first
+
+Load and profile the page in **WebKit first**: Safari through `safaridriver`
+(WebDriver; `sudo safaridriver --enable` once) for a real browser, Playwright's
+`webkit` (the `webkit` project, `--browser webkit`, installed with
+`npx playwright install webkit`) for scripted runs and traces, Safari Web
+Inspector's Timelines for debugging. On macOS open a page with
+`open -a Safari <url>`, not the system default browser, which may be another
+engine. An automation library (browser-use and the like) runs on its
+WebKit/Safari backend where it has one. WebKit has the narrowest support
+envelope of the big three — a regression that only iOS Safari users feel is
+invisible to every Chrome tool below.
+
+**Lighthouse, PageSpeed Insights, CrUX, a CDP trace and the chrome-devtools MCP
+are Chromium by definition** — they stay in this workflow as the **stated
+Chromium exception**: use them when the task needs Chrome itself, and say which
+and why. Prefer the Chrome Dev build for a Chrome run you start; give it a
+temporary profile (never the user's), record what you started, and close every
+process you started before you finish. A page checked only in Chromium is
+reported as "checked only in Chromium", never as "tested in a browser"; a
+Lighthouse score is a Chrome lab number, not a cross-browser verdict.
 
 ## Core Web Vitals, and the diagnostics beside them
 
@@ -198,8 +215,13 @@ how a typo survives review.
 - **Not Claude Code** (Cursor, Codex, the skills CLI, the API container): the pack's
   `PreToolUse` gate does not run — every rule here still applies, enforced by a person
   instead of a hook.
-- **No browser channel** (no Chrome DevTools MCP, no Playwright): a page is judged from
+- **No browser channel** (no `safaridriver`, no Playwright `webkit`, no Chrome DevTools MCP): a page is judged from
   the diff and the numbers are not measured on this machine. Record the weaker claim;
   a Lighthouse score nobody ran is not a score.
 - **No network**: PageSpeed Insights and field data are unavailable. Lab reasoning is
   still worth doing — say which half you did.
+
+## Triggers
+
+More phrases that route here: "performance audit", "LCP", "CLS", "INP", "render-blocking",
+"code splitting", "lazy loading", "cache headers", "оптимизация скорости".

package/plugins/sheleg-dev/skills/frontend-performance/references/accessibility-perf.md

@@ -56,7 +56,7 @@ If you need visual hierarchy without reducing contrast below WCAG thresholds:
 
 ### Checking Contrast
 
-Use Chrome DevTools: inspect element -> color picker shows contrast ratio against computed background.
+Inspect in Safari Web Inspector first: the Computed styles give the text colour and, on the element or the ancestor that paints it, the background colour; and the formula below gives the ratio. Chrome DevTools' color picker shows the contrast ratio directly — a Chromium tool, so name it as the engine you checked in.
 
 Or calculate manually: `(L1 + 0.05) / (L2 + 0.05)` where L1 is the lighter relative luminance.
 

package/plugins/sheleg-dev/skills/google-auth/SKILL.md

@@ -1,16 +1,11 @@
 ---
 name: google-auth
 description: >-
-  Use when a server authenticates to Google in a Node.js or Python application — OAuth 2.0
-  flows, verifying Google ID tokens server-side, service account authentication and keys,
-  Application Default Credentials, Workload Identity Federation, API keys, or working with
-  google-auth-library (Node.js) or google-auth (Python). Covers server-side ID token
-  verification and security best practices. Triggers - "google auth", "OAuth 2.0 Google",
-  "google-auth-library", "ADC", "Application Default Credentials", "service account",
-  "Workload Identity Federation", "Google ID token", "verifyIdToken",
-  "GOOGLE_APPLICATION_CREDENTIALS", "Google SSO", "авторизация Google", "сервисный аккаунт",
-  "ключи сервисного аккаунта", "проверить ID-токен". For end-user web sign-in only, use the
-  google-signin skill instead.
+  Use when a Node.js or Python server authenticates to Google: OAuth 2.0 flows, server-side
+  ID token verification, service accounts, Application Default Credentials, Workload
+  Identity Federation, API keys. Not for end-user web sign-in (google-signin). Opt out: no
+  wiring, без обвязки. Triggers - "google auth", "google-auth-library", "service account",
+  "ADC", "verifyIdToken", "авторизация Google", "сервисный аккаунт".
 license: MIT
 ---
 
@@ -289,3 +284,9 @@ if credentials.expired and credentials.refresh_token:
 - **No browser, or no console access**: the consent screen and the client-id half are a
   human step. Name the exact screen and what is blocked, do the code half, and do not
   loop on a login only a person can complete.
+
+## Triggers
+
+More phrases that route here: "OAuth 2.0 Google", "Application Default Credentials",
+"Workload Identity Federation", "Google ID token", "GOOGLE_APPLICATION_CREDENTIALS", "Google
+SSO", "ключи сервисного аккаунта", "проверить ID-токен".

package/plugins/sheleg-dev/skills/google-signin/SKILL.md

@@ -1,15 +1,11 @@
 ---
 name: google-signin
 description: >-
-  Use when implementing, reviewing or debugging Google login / sign-in / sign-up on a website —
-  wiring the GIS button or One Tap, verifying Google ID tokens on the server, linking Google to
-  existing password accounts, or fixing "origin is not allowed for the given client ID". Covers
-  GCP OAuth client setup, backend ID-token verification, three-way account linking with the pre-
-  hijacking guard, login-CSRF defense, nonce/replay protection and a mandatory security
-  checklist. Triggers - "sign in with google", "google login", "google sign-in button", "GIS",
-  "google.accounts.id", "gsi/client", "verify google token", "one tap", "account linking",
-  "login csrf", "g_csrf_token", "вход через Google", "кнопка входа Google", "связать аккаунты",
-  "проверить токен Google". For the broader library surface use google-auth instead.
+  Use when implementing or debugging Google sign-in on a website: the GIS button or One Tap,
+  server-side ID token checks, linking Google to password accounts, login CSRF. Not for a
+  server authenticating to Google (google-auth). Opt out: no wiring, без обвязки. Triggers -
+  "sign in with google", "google login", "GIS", "one tap", "account linking", "вход через
+  Google", "связать аккаунты".
 license: MIT
 ---
 
@@ -163,3 +159,9 @@ attacker's account.
   the code, not by watching it work. Record that as the weaker claim it is.
 - **No console access**: creating the OAuth client is a human step; state it once, do
   the rest, and say what is waiting on it.
+
+## Triggers
+
+More phrases that route here: "google sign-in button", "google.accounts.id", "gsi/client",
+"verify google token", "login csrf", "g_csrf_token", "кнопка входа Google", "проверить токен
+Google", "origin is not allowed for the given client ID".

package/plugins/sheleg-dev/skills/stripe-billing/SKILL.md

@@ -1,21 +1,12 @@
 ---
 name: stripe-billing
 description: >-
-  Use when connecting a product to Stripe, fixing a payment bug
-  ("баг в оплате", "оплата"), or auditing a live integration: checkout,
-  renewals, seats, proration, refunds, cancellation and the cancel-step
-  coupon, the portal, and the webhook that turns a payment into an
-  entitlement. Covers Stripe's agent toolchain, the pinned API version, SDK
-  retries, price resolution, claim-first webhook idempotency, what
-  billing_reason decides, cumulative refunds, the cancellation field
-  flexible billing_mode moved, retention eligibility Stripe cannot express,
-  and write ordering with compensating reverts. Triggers - "add Stripe",
-  "Stripe checkout", "subscription billing", "webhook signature",
-  "invoice.paid", "proration", "refund", "cancel subscription",
-  "retention coupon", "подключить Stripe", "оплата подпиской",
-  "вебхук Stripe", "скидка при отмене", "биллинг подписок". Not for choosing
-  between Stripe products (stripe-best-practices) or reading Stripe docs
-  (stripe-docs).
+  Use when connecting a product to Stripe, fixing a payment bug ("баг в оплате") or auditing
+  a live integration: checkout, renewals, refunds, cancellation and the retention coupon,
+  and the webhook that grants an entitlement. Not for crypto (crypto-payments). Opt out: no
+  wiring, без обвязки. Triggers - "add Stripe", "Stripe checkout", "subscription billing",
+  "webhook signature", "cancel subscription", "подключить Stripe", "оплата подпиской",
+  "вебхук Stripe".
 license: MIT
 ---
 
@@ -416,3 +407,7 @@ The full security checklist lives in `references/stripe-agent-toolchain.md`; eve
 pitfall it used to list is stated where the rule is, which is the only place it can
 be kept true.
 
+## Triggers
+
+More phrases that route here: "invoice.paid", "proration", "refund", "retention coupon",
+"скидка при отмене", "биллинг подписок", "оплата".