@ssheleg/sheleg-dev 0.7.0 → 0.9.0

package/CHANGELOG.md

@@ -4,6 +4,120 @@ All notable changes to this project are documented here.
 Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 Versioning: [SemVer](https://semver.org/spec/v2.0.0.html).
 
+## v0.9.0 — 2026-08-24
+
+### The pack that wires integrations had nothing about knowing when they break
+
+Six skills covered taking money, tracking conversions, signing people in and
+page speed. None covered the layer that says any of it stopped working: a `grep`
+for `sentry` across the whole family returned two incidental mentions.
+
+`error-tracking` is written from a measured baseline rather than an imagined
+one. An agent solving this exact task without the skill, in one session, made
+four failures that were recorded as they happened:
+
+- **Called "get a DSN" a manual step needing an account.** The account existed
+  and the CLI was already authenticated. Error tracking stayed off for no reason.
+- **Wrote a `before_send` scrubber without knowing `EventScrubber` exists** and
+  runs by default — so it could not say which layer covered what, or whether its
+  own code was redundant or load-bearing.
+- **Did not know the MCP is OAuth**, and would have declared it in the machine's
+  shared gateway, where an OAuth flow cannot complete.
+- **Would have set a DSN and stopped**, leaving every issue attached to a release
+  with no commits and suspect-commit attribution permanently dead.
+
+### The measurement the skill is built on
+
+`sentry-sdk` 2.19.2, run 2026-08-24. The built-in `EventScrubber` is enabled by
+default and matches on KEY NAMES against a 32-entry denylist. It does not inspect
+string values, and neither `dsn` nor `database_url` is on that list.
+
+```python
+event = {"message": "could not connect to postgresql://u:SUPERSECRET@host/db"}
+EventScrubber().scrub_event(event)
+assert "SUPERSECRET" in str(event)   # passes — not scrubbed
+```
+
+A service that writes a database URL near an error therefore starts forwarding
+that password to a third party the moment Sentry is added, with wider reach than
+the log had. The skill ships both layers — and, more usefully, the test that
+asserts layer one alone still leaks, so the day Sentry starts scrubbing values a
+red test says the second layer may now be redundant.
+
+### Also in this release
+
+- The 403 that reads as an auth failure and is not: `allowMemberProjectCreation:
+  false` blocks `project create` **even for an org owner**, because the policy is
+  evaluated against the token's scopes and the device-flow token carries no
+  `org:write`. The team-scoped endpoint fails identically. Measured, with the
+  three ways out ranked.
+- Two different tools are called `sentry`. Commands from one silently do not
+  exist in the other, and they install into prefixes where the older copy tends
+  to win — 0.38.0 shadowing 0.43.0, observed here. The shadow check is one line.
+- `$schema` was missing from `plugin.json` and from the marketplace entry. Added.
+
+## v0.8.0 — 2026-08-20
+
+**The self-test that proved the money invariants was measuring one thing and claiming
+another.** `--self-test` deleted a rule, ran an invariant, and asked whether the invariant
+went red. Twelve invariants carried **45 `assert.` calls**, and the verdict line called
+them *"12 assertions, each watched failing"* — so any assertion that was not the sole
+discriminator of a rule could be replaced by `assert.ok(true)` and nothing anywhere would
+notice. Measured against the shipped v0.7.0 pack: three neutered assertions (the
+`clawbacks.map` deepEqual, the `mirror.periodEnd` equality, the `response.body` deepEqual)
+left `--self-test` at exit 0 and `npm test` at 0. The same hole in `ad-tracking`, in the PII
+guard `references/meta-linkedin.md` advertises by name.
+
+The `assert` an invariant receives is now a recorder: a failure is remembered instead of
+thrown, so the assertions after it still run, and each call site is one measurement
+identified by its line. **37 of 45 watched failing, one call site at a time. Eight declared
+`assert.unmutated`** — an assertion no rule in the pack varies — **and measured unbreakable,
+with the reason at the call site.** Both directions: an `unmutated` assertion a mutant does
+break is a failure too, or the escape hatch is the bypass. Four assertions that were being
+pre-empted by a `TypeError` on the line above them became measurable rather than declared
+away. `test/fixtures_test.js` grew three plants, one of them the NON-first assertion inside
+a multi-assert invariant — the plant that used to pass.
+
+Then the sweep that started there and did not stop:
+
+- **The validator's check count did not count checks.** `checks = 10 + len(skill_dirs)`, so
+  adding a skill moved the number and adding a check did not — and five ledger rows read it
+  as evidence a guard had arrived. Every check is registered; the verdict prints the
+  registry's length, and the ledger's quoted copy of that line is compared against it.
+- **The ledger described an artifact nobody ships.** Its shipped block was headed `v0.6.0`
+  while `v0.7.0` was tagged and on npm, and 37 rows read *verified locally · unreleased*
+  under four blocks closing *"Nothing was released."* The heading is now compared against
+  `git describe --tags` and against `package.json`.
+- **The `mcp__.*` half of the manual gate had no guard.** Deleting that entry from
+  `hooks/hooks.json` left all three suites green, while the decision module does refuse
+  `mcp__…__create_refund` by name. And `README.md`'s copy-channel snippet registered one
+  matcher against the plugin's two — a weaker gate handed out by the document that exists
+  because the channel has none. Both are now checked; the snippet by matcher set.
+- **This repository measured no body budget at all**, so `crypto-payments/SKILL.md` sat past
+  the house working limit and was caught by another repository's auditor. Measured here now,
+  and the skill was **split rather than trimmed**: `references/callback-route-hardening.md`
+  and `references/testing-and-local-dev.md`, 4894 → 4387 tokens. All six skills `0 GAP`.
+- **Counted numbers became computed ones.** Seven in `SECURITY.md` (all four correct on the
+  day they were written, three of them moved by this change) and two in
+  `docs/evals/stripe-billing.md`, which restated `4994` tokens / `441` lines / `0 GAP, 13
+  PASS` against a measured 4747 / 409 / `0 GAP, 14 PASS`.
+- **A document that ships now resolves against the tarball, not only against a clone.**
+  `SECURITY.md` sent a reader to two documents `npm pack` does not contain.
+- **`docs/` joined the checked corpus**, with every document in it classified as live or as
+  a dated record — `docs/AGENT_SYNC.md` had been naming six paths this repository does not
+  have.
+- **`.claude/agent-sync.json` pointed at a file that did not exist** and guarded the ledger
+  without guarding the board.
+- **`CONTRIBUTING.md` called the gate two suites and it runs three**; the PR template asked
+  for one third of it. Both derive the list from `package.json` → `scripts.test` now.
+- **`install.sh` — the channel that `rm -rf`s each destination — printed no notice** that
+  the gate does not travel with it, while the npm installer did.
+
+Fourteen negative self-tests were added, one per guard, and all **42** were watched refusing
+their plants on a green tree. CI run `32293489020` at `6f66255` — 39 steps, 39 `success`,
+28 of 28 negatives — retires the *"CI has not seen any of this"* limitation the ledger had
+recorded four separate times.
+
 ## v0.7.0 — 2026-08-19
 
 **The pack that takes money had the weakest controls in the family, and every one of them

package/README.md

@@ -7,7 +7,7 @@ Part of the [ssheleg skill family](https://github.com/ssheleg/sshlg-skills).
 
 ---
 
-## The six skills
+## The seven skills
 
 | Skill | Answers |
 |---|---|
@@ -17,13 +17,15 @@ Part of the [ssheleg skill family](https://github.com/ssheleg/sshlg-skills).
 | **`google-signin`** | how do I let people sign in with Google without handing someone their account |
 | **`google-auth`** | how does my *server* authenticate to Google — OAuth, ADC, service accounts, federation |
 | **`frontend-performance`** | why is the Lighthouse score bad and which fix actually moves it |
+| **`error-tracking`** | how do I know it broke, without mailing my own credentials to Sentry |
 
 Each carries its own references and loads them only when the work reaches them.
 
 **Two of them ship a suite rather than a warning.** `stripe-billing` and `ad-tracking`
 carry a `fixtures/` directory — real provider webhook bodies, an assertion pack, and a
-`--self-test` that deletes one rule at a time so you can watch every assertion fail. Copy
-the directory in and run it:
+`--self-test` that deletes one rule at a time so you can watch every assertion fail — one
+call site at a time, which is not the same thing as one invariant at a time. Copy the
+directory in and run it:
 
 ```bash
 node plugins/sheleg-dev/skills/stripe-billing/fixtures/assert-money-invariants.mjs --self-test
@@ -88,7 +90,7 @@ a Lighthouse score.
 /plugin install sheleg-dev@sheleg-dev
 ```
 
-**npm installer** — copies all six skills into `~/.claude/skills/`:
+**npm installer** — copies all seven skills into `~/.claude/skills/`:
 
 ```bash
 npx @ssheleg/sheleg-dev
@@ -158,17 +160,29 @@ settings, by design.
   with the plugin and the hook is live as soon as the plugin is enabled. Nothing further
   to do, and no per-hook switch: enablement is the whole control.
 - **Installed by `npx @ssheleg/sheleg-dev`, `install.sh` or `npx skills add`** — those
-  copy the six skills into `~/.claude/skills/` and **carry no hook**. The gate is prose
+  copy the seven skills into `~/.claude/skills/` and **carry no hook**. The gate is prose
   again until you register it yourself, in `~/.claude/settings.json` or a project's
   `.claude/settings.json`:
 
   ```json
-  { "hooks": { "PreToolUse": [ { "matcher": "Bash",
+  { "hooks": { "PreToolUse": [
+    { "matcher": "Bash",
       "hooks": [ { "type": "command",
         "command": "node \"$HOME/.claude/skills/.sheleg-dev-hooks/money-gate.js\"",
-        "timeout": 15 } ] } ] } }
+        "timeout": 15 } ] },
+    { "matcher": "mcp__.*",
+      "hooks": [ { "type": "command",
+        "command": "node \"$HOME/.claude/skills/.sheleg-dev-hooks/money-gate.js\"",
+        "timeout": 15 } ] }
+  ] } }
   ```
 
+  **Both entries, not just the first.** A refund does not care which door it came
+  through: `create_refund` on an MCP server never touches a shell, and the table above
+  advertises it. Until 2026-08-20 this snippet carried the `Bash` matcher alone — a
+  weaker gate than the plugin's, handed out by the document that exists because the copy
+  channels have no gate at all. `test/validate.py` now compares the two matcher sets.
+
   Copy `plugins/sheleg-dev/hooks/` to that path first. `npx @ssheleg/sheleg-dev` prints
   this reminder; **nothing enforces it**, which is why the plugin channel is the
   recommended one.
@@ -219,8 +233,9 @@ matter does not error — hosts truncate it silently, which is worse); and
 dangling link nor a file nobody loads can ship.
 
 Plus, for the money fixtures, that every assertion has been watched failing and that no
-two rules are covering for each other — `test/fixtures_test.js` neuters three assertions
-and requires each pack's `--self-test` to notice.
+two rules are covering for each other — `test/fixtures_test.js` neuters assertions,
+including one that is **not** the first inside a multi-assert invariant, and requires each
+pack's `--self-test` to notice. That last plant is the one that used to pass.
 
 CI plants a defect against every one of those guards and requires the validator
 to fail. A green from a check nobody has watched fail is not evidence.

package/SECURITY.md

@@ -1,9 +1,10 @@
 # Security
 
-`sheleg-dev` is six skills about the layer a product reaches once it has users.
+`sheleg-dev` is seven skills about the layer a product reaches once it has users.
 Five of them touch other people's money or identity — Stripe billing, crypto
 payments, ad and conversion tracking, Google sign-in, server-side Google auth —
-and the sixth is front-end performance. That subject is the reason this document
+the sixth is front-end performance and the seventh is error tracking. Money is the
+reason this document
 has to be exact about the pack itself.
 
 Everything below is checkable from a clone, and the commands at the end are the
@@ -16,8 +17,8 @@ documents name that does not exist here.
 
 ## What ships, and what of it executes
 
-`git ls-files plugins` returns **50 files: 28 markdown, one plugin manifest, three
-files of the manual gate, and 18 files of money fixtures.** Two of the six skills now
+`git ls-files plugins` returns **56 files: 34 markdown, one plugin manifest, three
+files of the manual gate, and 18 files of money fixtures.** Two of the seven skills now
 ship code you can run — the assertion packs under `fixtures/` — and that is a change
 from every release before v0.7.0, so it is stated here rather than left to be noticed.
 They run only when you invoke them, read only the JSON fixtures beside them, and open
@@ -26,19 +27,23 @@ no socket; the greps below prove all three.
 | Component | Count | Runtime behavior |
 |---|---|---|
 | `SKILL.md`, one per skill | 6 | Text. Read by the agent, executes nothing. |
-| `references/` files, loaded on demand | 20 | Text. Same. |
+| `references/` files, loaded on demand | 25 | Text. Same. |
 | `plugins/sheleg-dev/.claude-plugin/plugin.json` | 1 | Manifest read by Claude Code. |
 | `plugins/sheleg-dev/hooks/hooks.json` | 1 | Hook manifest read by Claude Code. Declares one `PreToolUse` hook and no `if` filter. |
 | `plugins/sheleg-dev/hooks/money-gate.js` | 1 | Runs on a tool call, when the plugin is enabled. Requires `path` and its own decision module — nothing else. Reads stdin, writes one JSON line, exits 0 on every path. |
 | `plugins/sheleg-dev/hooks/lib/moneygate.js` | 1 | Pure. Payload and environment in, verdict out. No `require` at all, no filesystem, no clock. |
 | `bin/sheleg-dev.js` — the npm installer | 1 | Runs only when you invoke it. Node built-ins only: `fs`, `path`, `os`. |
-| `install.sh` — the shell installer | 1 | Runs only when you invoke it. Coreutils only: `cd`, `pwd`, `dirname`, `basename`, `mkdir`, `rm`, `cp`, `echo`. |
+| `install.sh` — the shell installer | 1 | **Not in the tarball** — `files` ships `bin/` and `plugins/`, so this one reaches you only through a clone. Runs when you invoke it. Coreutils only: `cd`, `pwd`, `dirname`, `basename`, `mkdir`, `rm`, `cp`, `echo`. It is the destructive channel: `rm -rf` per skill, then `cp -R`. |
 | `plugins/sheleg-dev/skills/*/fixtures/*.json` — webhook payloads | 12 | Data. Placeholder ids only; no key, token, signing secret or real customer id. |
 | `plugins/sheleg-dev/skills/*/fixtures/*.mjs` — the assertion packs and their reference implementations | 4 | Runs only when you invoke it. Reads the JSON beside it with `readFileSync` and nothing else: no `child_process`, no `fetch`, no write, no `process.env`. |
 | `plugins/sheleg-dev/skills/*/fixtures/manifest.json` and its `README.md` | 4 | Text. The invariant-to-fixture-to-document map, which `test/validate.py` reads. |
 
-The published tarball is those plus `README.md`, `CHANGELOG.md`, `SECURITY.md`,
-`LICENSE` and `package.json` — 56 files, listed by `npm pack --dry-run`.
+The published tarball is `bin/` and `plugins/` plus `README.md`, `CHANGELOG.md`,
+`SECURITY.md`, `LICENSE` and `package.json` — 62 files, listed by
+`npm pack --dry-run`. `install.sh`, `test/`, `docs/` and `CONTRIBUTING.md` are **not**
+in it; `test/validate.py` now refuses a path these shipped documents name that the
+tarball does not carry, because resolving in a clone is the wrong question for a
+document that ships.
 
 **The gate can refuse a command and can never run one.** `money-gate.js` requires
 `path` and the decision module; the decision module requires nothing. There is no
@@ -55,11 +60,11 @@ nothing but the CLI you typed.
 
 ## What the installers read and write
 
-Both do one thing: copy the six skill directories out of the package into
+Both do one thing: copy the seven skill directories out of the package into
 `~/.claude/skills/<name>`.
 
 - **Read:** only files inside the package.
-- **Write:** only `~/.claude/skills/` — six directories, named for the six skills.
+- **Write:** only `~/.claude/skills/` — seven directories, named for the seven skills.
   Nothing else on the filesystem, nothing outside `$HOME`.
 - **Network: none.** Neither file opens a socket or resolves a hostname.
   `bin/sheleg-dev.js` requires `fs`, `path` and `os` and nothing else — no
@@ -71,7 +76,7 @@ Both do one thing: copy the six skill directories out of the package into
 
 **One destructive difference between the two installers.** `bin/sheleg-dev.js`
 skips a skill that is already installed and says so, unless you pass `--force`
-(`bin/sheleg-dev.js:45-46`). `install.sh` does not ask: for each of the six names
+(`bin/sheleg-dev.js:45-46`). `install.sh` does not ask: for each of the seven names
 it runs `rm -rf` on the destination and re-copies, every time
 (`install.sh:21-22`). If you have hand-edited an installed skill, the shell
 installer deletes your edits and the node installer does not.
@@ -136,12 +141,15 @@ environment variables, never in source and never in logs:
 
 ## Where the real risk is
 
-Not the bytes — the advice. These six skills describe Stripe, Heleket and BTCPay,
+Not the bytes — the advice. These seven skills describe Stripe, Heleket and BTCPay,
 Google Sign-In, Workload Identity Federation, four ad platforms and browser
 defaults, and every one of those changes. **A claim here that a provider has since
 changed is a security defect in this pack**, not merely a stale doc, and it is the
-exposure `docs/evidence/verification.md` names as the largest one this repository
-does not test. `CONTRIBUTING.md` requires a claim about what a provider does
+exposure the verification ledger names as the largest one this repository does not
+test. **Neither that ledger nor the contributor guide is in this tarball** —
+`docs/evidence/verification.md` and `CONTRIBUTING.md` live in the git repository at
+<https://github.com/ssheleg/sheleg-dev>, and until 2026-08-20 this paragraph named
+both as if you had them. The guide requires a claim about what a provider does
 *today* to carry the date it was true. If you find one that has rotted, report it
 with what the correct claim is and what backs it.
 
@@ -161,7 +169,7 @@ git clone https://github.com/ssheleg/sheleg-dev && cd sheleg-dev
 # self-describing documents name -- this file included.
 python3 test/validate.py
 
-# The shipped payload: 50 files.
+# The shipped payload: 56 files.
 git ls-files plugins
 
 # 22 lines: the plugin manifest, the three files of the manual gate, and the 18
@@ -176,11 +184,13 @@ grep -nE "\brequire\(" plugins/sheleg-dev/hooks/money-gate.js plugins/sheleg-dev
 grep -nE "child_process|\bfetch\(|require\('(http|https|net|fs|dns|tls)'\)|spawn\(|execFile|writeFile|appendFile|unlink" \
   plugins/sheleg-dev/hooks/money-gate.js plugins/sheleg-dev/hooks/lib/moneygate.js
 
-# Both directions of the gate, watched: 65 fixtures, refusals and allow-plants.
+# Both directions of the gate, watched: every refusal and every false-positive
+# plant. The command prints its own count -- this document does not restate it.
 node test/moneygate_test.js
 
 # The money fixtures: both assertion packs against their reference implementation, both
-# --self-test runs, and three plants that neuter an assertion. 13 checks.
+# --self-test runs (per ASSERTION, not per invariant), and the plants that neuter one.
+# The command prints its own count.
 node test/fixtures_test.js
 
 # What the assertion packs cannot reach: NO OUTPUT, and grep exits 1 because it
@@ -196,6 +206,6 @@ grep -nE "require|child_process|exec|spawn|fetch|socket|rm -rf|cp -R|copyFileSyn
 # Live-key shapes across the skill payload: one line, and it is a placeholder.
 grep -rnE "sk_live_[A-Za-z0-9]|rk_live_[A-Za-z0-9]|whsec_[A-Za-z0-9]{8}|BEGIN [A-Z ]*PRIVATE KEY" plugins
 
-# What npm publishes, and nothing else: 56 files.
+# What npm publishes, and nothing else: 62 files.
 npm pack --dry-run
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ssheleg/sheleg-dev",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "Six integration skills for the layer a product reaches once it has users: Stripe subscription billing, crypto payments, ad and conversion tracking under Consent Mode v2, Google sign-in and the wider Google auth surface, and Core Web Vitals. This package is the installer CLI.",
   "bin": {
     "sheleg-dev": "bin/sheleg-dev.js"
@@ -43,6 +43,8 @@
     "skill"
   ],
   "scripts": {
-    "test": "python3 test/validate.py && node test/moneygate_test.js && node test/fixtures_test.js"
+    "test": "python3 test/validate.py && node test/moneygate_test.js && node test/fixtures_test.js",
+    "test:negatives": "python3 test/negatives.py",
+    "test:all": "python3 test/validate.py && node test/moneygate_test.js && node test/fixtures_test.js && python3 test/negatives.py"
   }
 }

package/plugins/sheleg-dev/.claude-plugin/plugin.json

@@ -1,8 +1,9 @@
 {
+  "$schema": "https://json.schemastore.org/claude-code-plugin.json",
   "name": "sheleg-dev",
   "displayName": "Sheleg Dev",
-  "description": "The integration layer a product needs once it has users: Stripe subscription billing reconciled into your own database, crypto payments that survive over-payment and duplicate webhooks, ad and conversion tracking under Consent Mode v2, Google sign-in with the account-linking guards, the wider Google auth surface, and Core Web Vitals work that moves the score.",
-  "version": "0.7.0",
+  "description": "The integration layer a product needs once it has users: Stripe subscription billing reconciled into your own database, crypto payments that survive over-payment and duplicate webhooks, ad and conversion tracking under Consent Mode v2, Google sign-in with the account-linking guards, the wider Google auth surface, and Core Web Vitals work that moves the score, and Sentry error tracking wired so it does not forward your own credentials to a third party and so a stack trace names the commit that caused it.",
+  "version": "0.9.0",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"
@@ -23,6 +24,9 @@
     "oauth2",
     "core-web-vitals",
     "claude-code",
-    "cursor"
+    "cursor",
+    "sentry",
+    "error-tracking",
+    "observability"
   ]
 }

package/plugins/sheleg-dev/skills/ad-tracking/fixtures/README.md

@@ -3,12 +3,13 @@
 **Copy this whole directory into your repository.** It is the executable half of what
 `SKILL.md` → *E-commerce* and `references/meta-linkedin.md` →
 *Deduplication with the Conversions API* state in prose: the three payloads one purchase
-produces, six assertions a correct emitter must pass, and a self-test that breaks the
-emitter one rule at a time so you can watch every assertion fail.
+produces, six invariants a correct emitter must hold — 12 assertions between them — and a
+self-test that breaks the emitter one rule at a time so you can watch each assertion fail
+on its own.
 
 ```bash
-node assert-dedup-contract.mjs              # 6 assertions against the reference emitter
-node assert-dedup-contract.mjs --self-test  # break one rule at a time; every assertion must go red
+node assert-dedup-contract.mjs              # 6 invariants / 12 assertions
+node assert-dedup-contract.mjs --self-test  # break one rule at a time; EACH ASSERTION must go red
 ```
 
 No dependencies, no network, **no access token anywhere in this directory** — the sink