@ssheleg/sheleg-dev 0.4.0 → 0.4.2

package/CHANGELOG.md

@@ -4,6 +4,38 @@ All notable changes to this project are documented here.
 Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 Versioning: [SemVer](https://semver.org/spec/v2.0.0.html).
 
+## v0.4.2 — 2026-08-13
+
+Its own negative self-tests could not be run on a developer's machine, and one of
+them had been reporting a healthy guard as broken since 2026-08-12.
+
+### Fixed
+
+- **`main` was red for two days over a guard that works.** The over-long-description
+  plant replaced the literal `"BTCPay".`; the description stopped containing it, so
+  `str.replace` changed nothing, the validator honestly passed, and the step printed
+  *ERROR: validator accepted a description past the 1024-char limit*. Re-anchored on the
+  folded `>-` block's SHAPE and proven: the plant now produces a 1204-char description
+  and the validator rejects it. Standing instruction #6 of the family's retro, which
+  names this exact failure in another member.
+- **Three plants used `sed -i` and were no-ops on macOS.** BSD sed requires an argument
+  to `-i`, so they errored and changed nothing; they could only ever be exercised in CI,
+  which is how the broken one went unnoticed. Converted to Python — the rule
+  `task-pipeline` has enforced on itself for months.
+- **Every plant now asserts that it changed the file.** A plant that stops landing says
+  `PLANT DID NOT LAND: <why>` instead of blaming the guard it can no longer disarm.
+
+All four verified by running them: each lands, and each makes the validator fail.
+
+## [0.4.1] — 2026-08-12
+
+### Changed
+
+- **`ad-tracking`'s body is back inside the token budget** — ~5076 → ~4802 of 5000.
+  The `Deep references` table was carrying a paragraph per file; each reference now
+  opens with its own `Load this when` line, so the trigger has one home, the table is
+  an index, and the two cannot drift apart.
+
 ## [0.4.0] — 2026-08-12
 
 ### Changed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ssheleg/sheleg-dev",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "Six integration skills for the layer a product reaches once it has users: Stripe subscription billing, crypto payments, ad and conversion tracking under Consent Mode v2, Google sign-in and the wider Google auth surface, and Core Web Vitals. This package is the installer CLI.",
   "bin": {
     "sheleg-dev": "bin/sheleg-dev.js"

package/plugins/sheleg-dev/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "sheleg-dev",
   "displayName": "Sheleg Dev",
   "description": "The integration layer a product needs once it has users: Stripe subscription billing reconciled into your own database, crypto payments that survive over-payment and duplicate webhooks, ad and conversion tracking under Consent Mode v2, Google sign-in with the account-linking guards, the wider Google auth surface, and Core Web Vitals work that moves the score.",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/sheleg-dev/skills/ad-tracking/SKILL.md

@@ -426,17 +426,17 @@ LinkedIn: [Insight Tag](https://www.linkedin.com/help/lms/answer/a418880).
 Compliance: [EU DMA](https://digital-markets-act.ec.europa.eu/).
 ## Deep references
 
-The sections above are the integration surface across four platforms. When the
-work is specifically Google's tag — and it usually becomes that — these carry
-the depth this file deliberately does not:
+The sections above are the integration surface across four platforms; these carry
+the depth this file deliberately does not. Each opens with its own **Load this
+when** line, so the trigger has one home and this table stays an index.
 
 | File | Read it when |
 |---|---|
-| [`references/consent-mode.md`](references/consent-mode.md) | **consent is the task**: advanced vs basic mode and what each still sends, all consent types, region-specific defaults, granular consent with its localStorage schema, the update flow, GTM wiring, exactly what tags do when denied, URL passthrough, ads data redaction, and how to verify in Tag Assistant / DevTools / DebugView |
-| [`references/gtag-api.md`](references/gtag-api.md) | you are **calling gtag directly**: every command (`config`, `event`, `set`, `get`, `consent`), tag-ID formats, parameter scope and precedence, `send_to` routing and groups, multi-product configuration, and the Next.js App Router integration including the Docker `NEXT_PUBLIC_*` build-time trap |
-| [`references/event-tracking.md`](references/event-tracking.md) | you are **designing the event schema**: recommended vs custom events, naming rules, parameter limits, the item object, the ecommerce funnel, SaaS/subscription events, and a typed `trackEvent` wrapper |
-| [`references/performance-security.md`](references/performance-security.md) | the tag is **costing you Lighthouse points or failing CSP**: loading strategies and their measured impact, CSP directives with and without a nonce, EU region endpoints, SPA page_view handling, and verification in the network tab |
-| [`references/meta-linkedin.md`](references/meta-linkedin.md) | the work is **Meta or LinkedIn rather than Google**: the parameter object per standard event, the firing wrapper and its consent gate, advanced matching with hashed identifiers and what must never be sent, and deduplication against the Conversions API |
+| [`references/consent-mode.md`](references/consent-mode.md) | **consent is the task** |
+| [`references/gtag-api.md`](references/gtag-api.md) | you are **calling gtag directly** |
+| [`references/event-tracking.md`](references/event-tracking.md) | you are **designing the event schema** |
+| [`references/performance-security.md`](references/performance-security.md) | the tag **costs Lighthouse points or fails CSP** |
+| [`references/meta-linkedin.md`](references/meta-linkedin.md) | the work is **Meta or LinkedIn rather than Google** |
 
 For the page-speed side of the same problem — what the tag does to LCP and TBT,
 and what to do about it — see the `frontend-performance` skill in this pack.

package/plugins/sheleg-dev/skills/ad-tracking/references/consent-mode.md

@@ -1,6 +1,8 @@
 # Consent Mode v2 — Detailed Patterns
 
 
+**Load this when** consent is the task: advanced vs basic mode and what each still sends, all consent types, region-specific defaults, granular consent with its localStorage schema, the update flow, GTM wiring, exactly what tags do when denied, URL passthrough, ads data redaction, and how to verify in Tag Assistant / DevTools / DebugView.
+
 ## Contents
 
 - [Table of Contents](#table-of-contents)

package/plugins/sheleg-dev/skills/ad-tracking/references/event-tracking.md

@@ -1,6 +1,8 @@
 # GA4 Event Tracking — Reference
 
 
+**Load this when** you are designing the event schema: recommended vs custom events, naming rules, parameter limits, the item object, the ecommerce funnel, SaaS/subscription events, and a typed `trackEvent` wrapper.
+
 ## Contents
 
 - [Table of Contents](#table-of-contents)

package/plugins/sheleg-dev/skills/ad-tracking/references/gtag-api.md

@@ -1,5 +1,7 @@
 # gtag.js API Reference
 
+**Load this when** you are calling gtag directly: every command (`config`, `event`, `set`, `get`, `consent`), tag-ID formats, parameter scope and precedence, `send_to` routing and groups, multi-product configuration, and the Next.js App Router integration including the Docker `NEXT_PUBLIC_*` build-time trap.
+
 Source: [Google Tag Platform — gtag.js](https://developers.google.com/tag-platform/gtagjs)
 
 ## Contents

package/plugins/sheleg-dev/skills/ad-tracking/references/meta-linkedin.md

@@ -1,5 +1,7 @@
 # Meta Pixel & LinkedIn — Reference
 
+**Load this when** the work is Meta or LinkedIn rather than Google: the parameter object per standard event, the firing wrapper and its consent gate, advanced matching with hashed identifiers and what must never be sent, and deduplication against the Conversions API.
+
 Moved out of `SKILL.md` when the body was 906 lines against a 500-line budget.
 Everything here is detail the body used to carry inline; the body keeps the
 setup snippet and the traps.

package/plugins/sheleg-dev/skills/ad-tracking/references/performance-security.md

@@ -1,6 +1,8 @@
 # GA4 Performance & Security — Reference
 
 
+**Load this when** the tag is costing you Lighthouse points or failing CSP: loading strategies and their measured impact, CSP directives with and without a nonce, EU region endpoints, SPA page_view handling, and verification in the network tab.
+
 ## Contents
 
 - [Table of Contents](#table-of-contents)