sshlg-skills 0.22.0 → 0.22.2

package/CHANGELOG.md

@@ -1,6 +1,27 @@
 # Changelog
 
-## v0.22.0 — 2026-08-05
+## v0.22.2 — 2026-08-05
+
+### Fixed
+- **`--dry-run` previewed the refusal instead of the block.** Down a pipe it
+  reported `would-opt-out`, which answers "what happens if I decline" — not
+  the question a preview is asked. It now shows the block that would be
+  written and states plainly that nothing was changed and no consent was
+  requested or recorded.
+
+ — 2026-08-05
+
+### Fixed
+- **`lib/` was missing from the published package**, so `sshlg-skills routers`
+  died with `MODULE_NOT_FOUND` for anyone installing through npx. The code was
+  correct and complete in the repository and absent from the tarball —
+  `files[]` listed `bin` and not `lib`.
+- `test/validate.py` now derives the requirement from the source: every
+  `require('../…')` in `bin/` must have its top-level directory in `files[]`.
+  A hand-kept list is what was already wrong, so the check reads the code
+  instead of trusting one.
+
+ — 2026-08-05
 
 ### Added
 - **`sshlg-skills routers`** — writes a managed routing block into the global

package/bin/sshlg-skills.js

@@ -225,9 +225,16 @@ function cmdRouters(f) {
 
   const mode = f.mode || 'install';
   let decision = 'yes';
-  if (mode === 'install') {
+  if (f.dryRun) {
+    // A preview answers "what would I get", not "what happens if I decline".
+    // Nothing is written either way, so it previews the block itself and says
+    // plainly that no decision was made.
+    log('--dry-run: показываю, что было бы записано. Ничего не изменено, ' +
+        'согласие не запрошено и не записано.');
+  } else if (mode === 'install') {
     decision = consent.askConsent({
       home,
+      persist: !f.dryRun,
       interactive: process.stdin.isTTY === true,
       prompt: (q) => { process.stdout.write(q); return readLineSync(); },
       log,

package/lib/apply.js

@@ -0,0 +1,118 @@
+'use strict';
+/**
+ * Writing the routing block to the operator's agent instruction files.
+ *
+ * This is the only module in the feature that touches disk, and it is
+ * deliberately thin: every decision about what the text should become was
+ * already made and tested in `routers.js`, without a filesystem. What is left
+ * here is which files to consider, and when not to write at all.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const R = require('./routers.js');
+
+/**
+ * The agents this family writes for, and the directory that proves each one
+ * is installed.
+ *
+ * The directory's existence is the evidence. An agent's home is never created
+ * — a file appearing under `~/.codex/` on a machine with no Codex is
+ * confusing at best, and at worst it is the launcher inventing a config for a
+ * tool the operator never chose.
+ */
+const TARGETS = [
+  { agent: 'claude', dir: '.claude', file: 'CLAUDE.md' },
+  { agent: 'codex', dir: '.codex', file: 'AGENTS.md' },
+];
+
+const EMPTY_BLOCK = [
+  R.BEGIN + ' — managed by sshlg-skills. To opt out: replace this whole block\n     with a single SSHLG:ROUTERS:OPTOUT comment line. -->',
+  '## Роутинг работы — семья ssheleg',
+  '',
+  '<!-- SSHLG:ROUTERS:TABLE:BEGIN -->',
+  '<!-- SSHLG:ROUTERS:TABLE:END -->',
+  R.END,
+  '',
+].join('\n');
+
+/**
+ * Record a refusal in the file itself.
+ *
+ * The state file is the launcher's memory; this marker is the operator's. It
+ * lives where they will see it, it survives a reinstall, a new machine's
+ * restored dotfiles, and a state file nobody knew about — and unlike a
+ * deleted block, it cannot be confused with a botched merge.
+ */
+function writeOptOut(file) {
+  const before = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : '';
+  if (R.OPTOUT_RE.test(before)) return { file, action: 'opted-out' };
+  const gap = before === '' ? '' : before.endsWith('\n') ? '\n' : '\n\n';
+  fs.writeFileSync(file, before + gap + R.OPTOUT + '\n', 'utf8');
+  return { file, action: 'opted-out-recorded' };
+}
+
+
+function applyOne(file, routers, opts) {
+  const exists = fs.existsSync(file);
+  const before = exists ? fs.readFileSync(file, 'utf8') : '';
+  const parsed = R.parse(before);
+
+  if (parsed.state === R.STATE.OPTED_OUT) return { file, action: 'opted-out' };
+  if (parsed.state === R.STATE.MALFORMED) return { file, action: 'malformed' };
+
+  let source = before;
+  if (parsed.state === R.STATE.ABSENT) {
+    // `update` refreshes what exists; it never introduces the block. A user
+    // who has not got one has not agreed to one, and an update is not the
+    // moment to ask.
+    if (opts.mode !== 'install') return { file, action: exists ? 'no-block' : 'absent' };
+    if (opts.consent === 'no') {
+      return opts.dryRun ? { file, action: 'would-opt-out' } : writeOptOut(file);
+    }
+    if (opts.consent !== 'yes') return { file, action: 'no-consent' };
+    const gap = !exists || before === '' ? '' : before.endsWith('\n') ? '\n' : '\n\n';
+    source = before + gap + EMPTY_BLOCK;
+  }
+
+  const result = R.upsert(source, routers);
+  const next = result.text;
+  if (next === before) return { file, action: 'unchanged' };
+
+  if (opts.dryRun) return { file, action: 'would-write', diff: R.diff(before, next) };
+
+  fs.writeFileSync(file, next, 'utf8');
+  return { file, action: exists ? 'updated' : 'created' };
+}
+
+/**
+ * Apply the routers to every agent instruction file that exists on this
+ * machine. Returns one record per considered target; writes nothing that the
+ * record does not report.
+ */
+function apply(opts) {
+  const home = opts.home;
+  const log = opts.log || ((m) => console.log(m));
+  const targets = [];
+
+  for (const t of TARGETS) {
+    const dir = path.join(home, t.dir);
+    if (!fs.existsSync(dir)) {
+      targets.push({ file: path.join(dir, t.file), action: 'agent-absent' });
+      continue;
+    }
+    const record = applyOne(path.join(dir, t.file), opts.routers || {}, opts);
+    targets.push(record);
+
+    if (record.action === 'malformed') {
+      log(
+        `${record.file}: блок роутинга повреждён (несбалансированные ` +
+        `маркеры) — ничего не записано. Почини вручную или удали блок целиком.`
+      );
+    }
+  }
+
+  return { targets };
+}
+
+module.exports = { apply, applyOne, writeOptOut, TARGETS, EMPTY_BLOCK };

package/lib/consent.js

@@ -0,0 +1,96 @@
+'use strict';
+/**
+ * Consent for editing the operator's global agent instructions.
+ *
+ * Installing a skill is not permission to change persistent instructions.
+ * That file governs every project and every session the operator runs, so the
+ * answer is asked once, recorded, and never asked again — and the absence of
+ * an answer is never treated as one.
+ *
+ * `home` is a parameter rather than `process.env.HOME` so the fixtures run
+ * against a temp directory and cannot reach the real state file.
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+function statePath(home) {
+  return path.join(home, '.sshlg-skills', 'state.json');
+}
+
+/** The recorded state, or `{}`. A file we cannot parse is not consent. */
+function readState(home) {
+  try {
+    const raw = fs.readFileSync(statePath(home), 'utf8');
+    const parsed = JSON.parse(raw);
+    return parsed && typeof parsed === 'object' ? parsed : {};
+  } catch (e) {
+    return {};
+  }
+}
+
+/** Merge `patch` into the recorded state. Owner-only, like anything else here. */
+function writeState(home, patch) {
+  const file = statePath(home);
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const next = Object.assign(readState(home), patch);
+  fs.writeFileSync(file, JSON.stringify(next, null, 2) + '\n', { mode: 0o600 });
+  // writeFileSync's mode is subject to umask on create and ignored entirely on
+  // an existing file, so the permission is set rather than requested.
+  fs.chmodSync(file, 0o600);
+  return next;
+}
+
+function defaultPrompt() {
+  // Node has no synchronous stdin read that works everywhere, so the caller in
+  // bin/ supplies the real prompt. Reaching this means an interactive path ran
+  // without one -- refuse loudly rather than return an empty string, which
+  // would read as a decline the operator never made.
+  throw new Error(
+    'askConsent: interactive mode needs a prompt function; none was supplied'
+  );
+}
+
+/**
+ * `"yes"` or `"no"`, asked at most once in the lifetime of a machine.
+ *
+ * A non-interactive stdin — CI, a piped installer, an automation — answers
+ * `"no"` and says so. Silence is not consent, and the one context where an
+ * unattended installer could quietly rewrite a global instruction file is
+ * exactly the one where nobody would notice.
+ */
+function askConsent(opts) {
+  const home = opts.home;
+  // A preview must not decide anything. Without this, `--dry-run` down a pipe
+  // records a permanent "no" -- the one flag whose whole promise is that it
+  // changes nothing.
+  const persist = opts.persist !== false;
+  const log = opts.log || ((m) => console.log(m));
+  const prompt = opts.prompt || defaultPrompt;
+
+  const recorded = readState(home).routers;
+  if (recorded === 'yes' || recorded === 'no') return recorded;
+
+  if (!opts.interactive) {
+    log(
+      'stdin не интерактивен — роутинг-блок не записан (non-interactive: ' +
+      'treating as no). Запусти `npx sshlg-skills install` в терминале, ' +
+      'чтобы решить.'
+    );
+    if (persist) writeState(home, { routers: 'no' });
+    return 'no';
+  }
+
+  const answer = String(
+    prompt(
+      'Дописать блок роутинга скилов в глобальные инструкции агента? ' +
+      'Он влияет на все проекты. [y/N] '
+    ) || ''
+  ).trim().toLowerCase();
+
+  const decision = answer === 'y' || answer === 'yes' || answer === 'д' ? 'yes' : 'no';
+  if (persist) writeState(home, { routers: decision });
+  return decision;
+}
+
+module.exports = { statePath, readState, writeState, askConsent };

package/lib/migrate.js

@@ -0,0 +1,80 @@
+'use strict';
+/**
+ * Moving hand-written router rules into the managed block.
+ *
+ * The rules an operator wrote themselves are better than the ones this
+ * package ships — not because the prose is nicer, but because the asides are
+ * load-bearing. "Прогонять десять стадий ради одного символа — самый быстрый
+ * способ научить обходить пайплайн стороной" is the sentence that makes the
+ * rule get followed rather than skimmed, and it is exactly the kind of line a
+ * rewrite smooths into nothing.
+ *
+ * So migration moves text; it never regenerates it. The packaged defaults are
+ * used only for a router the operator never wrote.
+ */
+
+/** Hand-written headings this migration recognises, and what they become. */
+// No \b here. JavaScript's word boundary is ASCII-only, so it never matches
+// after a Cyrillic letter -- `Роутинг работы\b` silently found nothing while
+// `UX scenarios\b` worked, because the latter happens to end in ASCII.
+const KNOWN_HEADINGS = [
+  { router: 'super-ux', match: /^##[ \t]+UX scenarios(?=[\s—-]|$).*$/m },
+  { router: 'task-pipeline', match: /^##[ \t]+Роутинг работы(?=[\s—-]|$).*$/m },
+];
+
+/** The index where the section starting at `from` ends: the next `## `, or EOF. */
+function sectionEnd(text, from) {
+  const next = text.slice(from).search(/^##\s/m);
+  return next === -1 ? text.length : from + next;
+}
+
+/**
+ * Find the hand-written rules without changing anything.
+ *
+ * Returns the body of each recognised heading verbatim — trimmed only of the
+ * blank lines that separate it from its neighbours, never reflowed.
+ */
+function extract(text) {
+  const routers = {};
+  const spans = [];
+
+  for (const { router, match } of KNOWN_HEADINGS) {
+    const hit = match.exec(text);
+    if (!hit) continue;
+    const start = hit.index;
+    const bodyFrom = start + hit[0].length;
+    const end = sectionEnd(text, bodyFrom);
+    const body = text.slice(bodyFrom, end).replace(/^\n+/, '').replace(/\n+$/, '');
+    if (body) {
+      routers[router] = body;
+      spans.push({ start, end, router });
+    }
+  }
+
+  spans.sort((a, b) => a.start - b.start);
+  return { routers, spans };
+}
+
+/**
+ * Remove the recognised headings and hand back their bodies.
+ *
+ * Spans are cut back to front so earlier indices stay valid, and the cut
+ * leaves exactly one blank line where the section was, so the surrounding
+ * document keeps its shape instead of collapsing.
+ */
+function migrate(text, opts) {
+  const { routers, spans } = extract(text);
+  const fallbacks = (opts && opts.fallbacks) || {};
+
+  let out = text;
+  for (const span of spans.slice().reverse()) {
+    const head = out.slice(0, span.start).replace(/\n+$/, '\n');
+    const tail = out.slice(span.end).replace(/^\n+/, '');
+    out = head + (head && tail ? '\n' : '') + tail;
+  }
+
+  const merged = Object.assign({}, fallbacks, routers);
+  return { text: out, routers: spans.length || Object.keys(fallbacks).length ? merged : {} };
+}
+
+module.exports = { extract, migrate, KNOWN_HEADINGS, sectionEnd };

package/lib/router-texts.js

@@ -0,0 +1,87 @@
+'use strict';
+/**
+ * The packaged router texts.
+ *
+ * These are defaults, not the truth. Where the operator already wrote a rule
+ * by hand, migration moves their wording in and these are never used — a rule
+ * someone wrote in their own words is followed, and a rule that arrived as
+ * boilerplate is skimmed.
+ *
+ * Each text carries four things, and the fixtures check for all of them: the
+ * rule, the boundary in both directions, the refusal phrase, and one sentence
+ * placing it against the other routers. A router without a boundary swallows
+ * everything and gets routed around within a week.
+ */
+
+const SUPER_UX = `**Если \`super-ux\` установлен, любая работа с пользовательским интерфейсом
+идёт через цепочку** — сначала сценарии и их валидация, потом интерфейс.
+\`docs/ux/scenarios.md\` — источник правды для user-facing поведения; файла нет
+→ предложи \`/ux\` до работы над UI. Изменение user-facing поведения обновляет
+сценарии тем же изменением. Проверка кода против сценариев — \`/ux-audit\`, с
+доказательствами \`file:line\`.
+
+**Граница — «у этого есть пользователь».** НЕ через цепочку: внутренние
+скрипты, миграции без интерфейса, работа с данными, инфраструктура. Рисовать
+сценарий для cron-джобы — способ научить обходить цепочку стороной.
+
+**Фраза отказа: «без сценариев».**
+
+**Место среди роутеров:** super-ux решает, что интерфейс должен делать;
+\`copywriting\` — как это звучит; \`task-pipeline\` — как изменение доедет до
+репозитория.`;
+
+const COPYWRITING = `**Если \`super-ux\` установлен, любой текст, который увидит пользователь
+продукта, пишется через \`copywriting\`** — строки интерфейса, ошибки, пустые
+состояния, лендинг, цены, блог, changelog для пользователей, посты, описание в
+сторе, объявления, письма. Первым действием скил читает бренд-пак
+(\`docs/brand/voice.md\`, \`terminology.md\`, \`facts.md\`); пака нет →
+\`/brand-init\` до письма, а не после.
+
+**Граница — «отгружается пользователю продукта».** НЕ через скил: коммиты и
+описания PR, комментарии в коде, README для разработчиков, внутренние доки,
+ответы в чате. Прогонять брендбук ради строки в CHANGELOG для разработчиков —
+самый быстрый способ научить меня обходить его стороной.
+
+**Фраза отказа: «без бренда» или «черновиком».** Работает на задаче, которая
+по границе прошла бы через скил: пишу напрямую и говорю вслух, что бренд-пак
+пропущен по просьбе, а не молча.
+
+**Место среди роутеров:** \`super-ux\` решает, что интерфейс должен делать;
+copywriting — как это звучит; \`task-pipeline\` — как изменение доедет до
+репозитория. Лендинг проходит все три; пост в соцсеть — только copywriting,
+репозиторий он не меняет.`;
+
+const TASK_PIPELINE = `**Если \`task-pipeline\` установлен, любая работа, которая МЕНЯЕТ РЕПОЗИТОРИЙ,
+идёт через него** — без отдельной просьбы. Фича, фикс, рефактор, миграция,
+интеграция, переписывание, внедрение, харденинг; на любом языке и любыми
+словами.
+
+**Граница — «меняет репозиторий», и она в обе стороны.** НЕ через пайплайн:
+вопрос и ответ на него, объяснение, чтение и разбор кода; опечатка,
+однострочная правка, механическое переименование; разведка и измерение,
+которые ничего не коммитят. Прогонять десять стадий ради одного символа — самый
+быстрый способ научить обходить пайплайн стороной.
+
+**Фраза отказа: «без пайплайна» или «quick».** Пограничный случай — называю,
+каким путём иду, одной строкой, а не выбираю молча.
+
+**Место среди роутеров:** \`super-ux\` решает, что интерфейс должен делать;
+\`copywriting\` — как это звучит; task-pipeline — как изменение доедет до
+репозитория.`;
+
+/** Skill name in `skills.json` → the router it contributes. */
+const BY_MEMBER = {
+  'super-ux': { 'super-ux': SUPER_UX, copywriting: COPYWRITING },
+  'task-pipeline': { 'task-pipeline': TASK_PIPELINE },
+};
+
+/** The routers contributed by the members actually installed. */
+function forMembers(names) {
+  const out = {};
+  for (const name of names || []) {
+    Object.assign(out, BY_MEMBER[name] || {});
+  }
+  return out;
+}
+
+module.exports = { SUPER_UX, COPYWRITING, TASK_PIPELINE, BY_MEMBER, forMembers };

package/lib/routers.js

@@ -0,0 +1,287 @@
+'use strict';
+/**
+ * The managed routing block — parsing and rendering only.
+ *
+ * This module never reads or writes a file. That is deliberate: it edits the
+ * operator's global agent instructions, a file governing every project and
+ * every session, and the rules that keep it intact should be provable without
+ * a HOME, a temp directory, or any code path capable of a write.
+ *
+ * The block is parsed into a list of segments and rendered by concatenating
+ * them, so a round-trip is byte-exact by construction rather than by care.
+ * Anything this module does not understand is carried through as chrome.
+ */
+
+const BEGIN = '<!-- SSHLG:ROUTERS:BEGIN';
+const END = '<!-- SSHLG:ROUTERS:END -->';
+const OPTOUT = '<!-- SSHLG:ROUTERS:OPTOUT -->';
+// Anchored to its own line on purpose: the block's header *names* this marker
+// so the operator can find the way out without reading documentation, and a
+// substring match would then read every managed file as opted out.
+const OPTOUT_RE = /^[ \t]*<!-- SSHLG:ROUTERS:OPTOUT -->[ \t]*$/m;
+
+const SECTION_RE =
+  /<!-- SSHLG:ROUTER:([a-z0-9-]+):BEGIN -->\n([\s\S]*?)\n<!-- SSHLG:ROUTER:\1:END -->/g;
+
+const STATE = {
+  ABSENT: 'absent',
+  OPTED_OUT: 'opted-out',
+  MALFORMED: 'malformed',
+  PRESENT: 'present',
+};
+
+function countOccurrences(text, needle) {
+  let count = 0;
+  let from = 0;
+  for (;;) {
+    const at = text.indexOf(needle, from);
+    if (at === -1) return count;
+    count += 1;
+    from = at + needle.length;
+  }
+}
+
+/**
+ * Split a block body into ordered segments.
+ *
+ * `chrome` is everything the parser does not own — the heading, blank lines,
+ * the table, and anything a future version writes that this one has never
+ * heard of. It is copied verbatim, which is what lets an older launcher meet
+ * a newer block without damaging it.
+ */
+function segment(block) {
+  const segments = [];
+  let cursor = 0;
+  SECTION_RE.lastIndex = 0;
+  let match;
+  while ((match = SECTION_RE.exec(block)) !== null) {
+    if (match.index > cursor) {
+      segments.push({ type: 'chrome', raw: block.slice(cursor, match.index) });
+    }
+    segments.push({
+      type: 'section',
+      name: match[1],
+      body: match[2],
+      raw: match[0],
+    });
+    cursor = match.index + match[0].length;
+  }
+  if (cursor < block.length) {
+    segments.push({ type: 'chrome', raw: block.slice(cursor) });
+  }
+  return segments;
+}
+
+/**
+ * Classify a file and, when it carries a well-formed block, take it apart.
+ *
+ * Order matters: the opt-out marker is checked first and outranks a present
+ * block, because a user who left that marker has said no in the only place
+ * that survives every reinstall.
+ */
+function parse(text) {
+  const source = typeof text === 'string' ? text : '';
+
+  if (OPTOUT_RE.test(source)) {
+    return { state: STATE.OPTED_OUT, before: source, block: '', after: '', segments: [], sections: [] };
+  }
+
+  const begins = countOccurrences(source, BEGIN);
+  const ends = countOccurrences(source, END);
+
+  if (begins === 0 && ends === 0) {
+    return { state: STATE.ABSENT, before: source, block: '', after: '', segments: [], sections: [] };
+  }
+  if (begins !== 1 || ends !== 1) {
+    return { state: STATE.MALFORMED, before: source, block: '', after: '', segments: [], sections: [] };
+  }
+
+  const beginAt = source.indexOf(BEGIN);
+  const endAt = source.indexOf(END);
+  if (endAt < beginAt) {
+    return { state: STATE.MALFORMED, before: source, block: '', after: '', segments: [], sections: [] };
+  }
+
+  let blockEnd = endAt + END.length;
+  if (source[blockEnd] === '\n') blockEnd += 1;
+
+  const block = source.slice(beginAt, blockEnd);
+  const segments = segment(block);
+  return {
+    state: STATE.PRESENT,
+    before: source.slice(0, beginAt),
+    block,
+    after: source.slice(blockEnd),
+    segments,
+    sections: segments.filter((s) => s.type === 'section'),
+  };
+}
+
+/** The block, rebuilt from its segments. Exact by construction. */
+function render(parsed) {
+  if (!parsed || !parsed.segments || !parsed.segments.length) return parsed && parsed.block ? parsed.block : '';
+  return parsed.segments.map((s) => s.raw).join('');
+}
+
+/**
+ * The precedence rows, in the only order they are ever rendered.
+ *
+ * The three routers are different axes rather than competing priorities: the
+ * first two decide what the change contains, the third how it reaches the
+ * repository. A landing page passes all three; a social post passes only
+ * copywriting, because it changes no repository.
+ */
+const ROUTER_ROWS = [
+  ['super-ux', 'что интерфейс должен делать', 'есть user-facing поведение'],
+  ['copywriting', 'как это звучит', 'есть текст, который увидит пользователь продукта'],
+  ['task-pipeline', 'как изменение доедет до репозитория', 'изменение касается репозитория'],
+];
+
+const TABLE_BEGIN = '<!-- SSHLG:ROUTERS:TABLE:BEGIN -->';
+const TABLE_END = '<!-- SSHLG:ROUTERS:TABLE:END -->';
+
+/** The table for exactly the routers present -- never a hand-kept list. */
+function renderTable(names) {
+  const present = ROUTER_ROWS.filter((row) => names.includes(row[0]));
+  if (!present.length) return `${TABLE_BEGIN}\n${TABLE_END}`;
+  const lines = [
+    TABLE_BEGIN,
+    '| Скил | Отвечает на | Когда |',
+    '|---|---|---|',
+    ...present.map(([name, answers, when]) => `| \`${name}\` | ${answers} | ${when} |`),
+    TABLE_END,
+  ];
+  return lines.join('\n');
+}
+
+function sectionRaw(name, body) {
+  return `<!-- SSHLG:ROUTER:${name}:BEGIN -->\n${body}\n<!-- SSHLG:ROUTER:${name}:END -->`;
+}
+
+/**
+ * Replace the bodies of the named sections, and nothing else.
+ *
+ * Sections not named are not rewritten -- they are not even re-rendered, they
+ * are the same segment objects carrying the same raw bytes. That is what lets
+ * the bundle installer and a single member's installer both write here
+ * without one silently reformatting the other's work.
+ *
+ * A file that is opted out, malformed, or has no block is returned untouched
+ * with its state, because none of those are conditions this module is allowed
+ * to resolve on its own.
+ */
+function upsert(text, routers) {
+  const parsed = parse(text);
+  const names = Object.keys(routers || {});
+
+  if (parsed.state !== STATE.PRESENT || !names.length) {
+    return { state: parsed.state, changed: false, text: typeof text === 'string' ? text : '' };
+  }
+
+  const segments = parsed.segments.slice();
+  for (const name of names) {
+    const raw = sectionRaw(name, routers[name]);
+    const at = segments.findIndex((s) => s.type === 'section' && s.name === name);
+    if (at !== -1) {
+      segments[at] = { type: 'section', name, body: routers[name], raw };
+      continue;
+    }
+    // New section: inside the chrome that holds the table, immediately before
+    // the table marker.
+    //
+    // Splitting the chrome matters. An empty block is a single chrome segment
+    // spanning BEGIN..END, so inserting *before that segment* puts the section
+    // outside the fence entirely — the file still looks plausible, the block
+    // still parses, and the section is silently no longer managed. Nothing is
+    // destroyed, which is why byte-preservation tests cannot see it.
+    const chromeAt = segments.findIndex(
+      (s) => s.type === 'chrome' && s.raw.includes(TABLE_BEGIN)
+    );
+    const newSection = { type: 'section', name, body: routers[name], raw };
+    if (chromeAt === -1) {
+      segments.push({ type: 'chrome', raw: '\n' }, newSection);
+      continue;
+    }
+    const chrome = segments[chromeAt];
+    const cut = chrome.raw.indexOf(TABLE_BEGIN);
+    segments.splice(
+      chromeAt,
+      1,
+      { type: 'chrome', raw: chrome.raw.slice(0, cut) },
+      newSection,
+      { type: 'chrome', raw: '\n\n' + chrome.raw.slice(cut) }
+    );
+  }
+
+  // The table is regenerated from the sections that survived, not from what
+  // the caller asked for: a section removed by hand must lose its row on the
+  // next write, or the table starts describing a router nobody has.
+  const present = segments.filter((s) => s.type === 'section').map((s) => s.name);
+  const tableAt = segments.findIndex(
+    (s) => s.type === 'chrome' && s.raw.includes(TABLE_BEGIN)
+  );
+  if (tableAt !== -1) {
+    const chrome = segments[tableAt];
+    const from = chrome.raw.indexOf(TABLE_BEGIN);
+    const to = chrome.raw.indexOf(TABLE_END);
+    if (from !== -1 && to !== -1 && to > from) {
+      segments[tableAt] = {
+        type: 'chrome',
+        raw:
+          chrome.raw.slice(0, from) +
+          renderTable(present) +
+          chrome.raw.slice(to + TABLE_END.length),
+      };
+    }
+  }
+
+  const block = segments.map((s) => s.raw).join('');
+  const out = parsed.before + block + parsed.after;
+  return { state: parsed.state, changed: out !== text, text: out };
+}
+
+/**
+ * A line diff for the dry run, so `--dry-run` shows the operator the change
+ * in the file's own words rather than a promise about it.
+ *
+ * Line-based and dependency-free: the launcher has no dependencies and this
+ * is not the feature that should give it one.
+ */
+function diff(before, after) {
+  if (before === after) return '';
+  const a = String(before).split('\n');
+  const b = String(after).split('\n');
+
+  // Longest common subsequence over lines, so unchanged context is not
+  // reported as a removal followed by an identical addition.
+  const lcs = Array.from({ length: a.length + 1 }, () => new Array(b.length + 1).fill(0));
+  for (let i = a.length - 1; i >= 0; i -= 1) {
+    for (let j = b.length - 1; j >= 0; j -= 1) {
+      lcs[i][j] = a[i] === b[j] ? lcs[i + 1][j + 1] + 1 : Math.max(lcs[i + 1][j], lcs[i][j + 1]);
+    }
+  }
+
+  const out = [];
+  let i = 0;
+  let j = 0;
+  while (i < a.length && j < b.length) {
+    if (a[i] === b[j]) {
+      i += 1;
+      j += 1;
+    } else if (lcs[i + 1][j] >= lcs[i][j + 1]) {
+      out.push(`-${a[i]}`);
+      i += 1;
+    } else {
+      out.push(`+${b[j]}`);
+      j += 1;
+    }
+  }
+  while (i < a.length) { out.push(`-${a[i]}`); i += 1; }
+  while (j < b.length) { out.push(`+${b[j]}`); j += 1; }
+  return out.join('\n');
+}
+
+module.exports = {
+  parse, render, segment, upsert, sectionRaw, renderTable, diff,
+  STATE, BEGIN, END, OPTOUT, OPTOUT_RE, SECTION_RE, ROUTER_ROWS,
+};

package/package.json

@@ -1,12 +1,13 @@
 {
   "name": "sshlg-skills",
-  "version": "0.22.0",
+  "version": "0.22.2",
   "description": "One launcher/updater for the ssheleg skill family (super-ux, task-pipeline, agent-sync, make-skill, sheleg-design, seo-aeo-audit) across every agent \u2014 Claude Code, Cursor, OpenCode, Kilo, Kimi, Hermes, OpenClaw, Codex, and more.",
   "bin": {
     "sshlg-skills": "bin/sshlg-skills.js"
   },
   "files": [
     "bin",
+    "lib",
     "skills.json",
     "README.md",
     "LICENSE",