Multi Section Patch v0.2.2

Multi Section Patch v0.2.2

Multi Section Patch v0.2.2 improves release provenance, installation
guidance, and public proof without changing the CLI, file formats, safety
model, or supported platforms.

Highlights

• Adds source and maintainer metadata to the distributed SKILL.md.
• Adds tag-only GitHub artifact attestations for all six native executables and
  SHA256SUMS.
• Adds a real two-file demonstration of the reviewed-plan workflow.
• Adds a reproducible, carefully scoped byte measurement without presenting it
  as a token, latency, cost, or model-quality benchmark.
• Makes GitHub CLI and npx skills installation guidance agent-neutral.
• Documents the current gh skill list command and keeps removal guidance
  limited to the exact installed skill directory.

Install or upgrade

Preview the skill before installing it:

gh skill preview rudra2112/multi-section-patch multi-section-patch

Install the tagged release for a supported coding agent:

gh skill install rudra2112/multi-section-patch multi-section-patch --agent AGENT_ID --scope user --pin v0.2.2

Replace AGENT_ID with a supported host ID such as claude-code, codex,
cursor, gemini-cli, or github-copilot.

The alternative npx skills installer is:

npx --yes skills@1.5.20 add rudra2112/multi-section-patch --skill multi-section-patch --agent AGENT_ID --yes

Node.js is required only while that optional installer runs. The installed
skill remains self-contained and requires no Python, Node.js, Go, compiler,
network connection, or background service during normal use.

Provenance and verification

The tagged GitHub Actions workflow:

• runs the test suite and go vet;
• executes native smoke tests on Windows, macOS, and Linux for x86-64 and
  ARM64;
• rebuilds all six executables twice and compares them byte for byte;
• verifies every entry in SHA256SUMS; and
• attests the released executables and checksum manifest.

After the tagged workflow succeeds, verify the artifact matching the current
platform from an exact v0.2.2 checkout:

gh attestation verify \
  skills/multi-section-patch/scripts/multi-section-patch-darwin-arm64 \
  --repo rudra2112/multi-section-patch

Replace the filename with the current platform's executable. An attestation
proves where those exact bytes were built; it does not replace source review,
checksum verification, or review of every dry-run diff.

Compatibility

This release does not change:

• selectors, edit specifications, JSON output, or exit behavior;
• the reviewed plan_sha256 required by --expect-plan;
• the supported Windows, macOS, and Linux x86-64 and ARM64 matrix; or
• the documented filesystem and metadata limits.

The bundled executables and their checksums are unchanged from v0.2.1
because this release contains documentation and workflow changes only.

Security

The executable does not interpret or execute selected file content. Agents
must continue to treat file names and selected content as untrusted data.

Report suspected vulnerabilities through the repository's
private vulnerability reporting
instead of opening a public issue.

Multi Section Patch v0.2.1

Test-only patch: corrects the Windows
exclusive-lock test for the reviewed-apply
workflow. Runtime behavior and bundled binaries
are unchanged.

Full Changelog: v0.2.0...v0.2.1

Multi Section Patch v0.1.1

Multi Section Patch v0.1.1

Multi Section Patch v0.1.1 fixes regular-expression selectors that use an
end-of-line anchor on ordinary text files.

Fixed

• Patterns ending in $, such as ^BEGIN$, now match the logical content of
  newline-terminated lines.
• The fix applies to both LF and CRLF files.
• The shared selector fix applies to both read and edit.
• Selected content and original line endings remain byte-for-byte unchanged.
• Literal markers, headings, line ranges, edit guards, and write behavior are
  unchanged.
• There is no CLI, JSON schema, or output-format change.

Documentation

• Every production Go function now has a concise doc comment describing its
  purpose and important mechanism or safety invariant.
• Package and command documentation remain available through standard Go
  tooling.

Install or upgrade

Review the exact tagged skill before installing:

gh skill preview rudra2112/multi-section-patch multi-section-patch@v0.1.1

Install or upgrade a user-scoped copy for a supported coding agent:

gh skill install rudra2112/multi-section-patch multi-section-patch --agent <agent-id> --scope user --pin v0.1.1

Common agent IDs include claude-code, codex, cursor, gemini-cli, and
github-copilot.

The installed skill remains self-contained and needs no Python, Node.js, Go,
compiler, network connection, or background service during normal use.

Verification

This patch includes rebuilt native executables and updated SHA-256 checksums
for all six supported operating-system and architecture pairs:

• macOS x86-64 and ARM64;
• Linux x86-64 and ARM64; and
• Windows x86-64 and ARM64.

The release candidate passed the full Go test suite, go vet, LF and CRLF
regression tests, checksum validation, native command smoke testing, and two
byte-for-byte identical all-target builds.

Security

Report suspected vulnerabilities through the repository's
private vulnerability reporting
instead of opening a public issue.

Multi Section Patch v0.1.0

Multi Section Patch v0.1.0

Multi Section Patch v0.1.0 is the first public release of a vendor-neutral
Agent Skill for precise, guarded reads and edits across multiple local text
files.

The installed skill is self-contained. It uses a bundled native executable and
needs no Python, Node.js, Go, compiler, network connection, or background
service during normal use.

Highlights

• Read exact sections from multiple files in one request.
• Select whole files, inclusive line ranges, literal markers, headings, or
  Go/RE2 regular-expression bounds.
• Receive canonical paths, resolved line ranges, exact content, and SHA-256
  digests for every selection.
• Preview a complete multi-file diff by default; write only with explicit
  --apply.
• Guard edits with expected_sha256 and must_contain.
• Reject invalid bounds, overlapping edits, stale targets, binary input, and
  ambiguous hard-linked files before writing.
• Stage replacement and recovery files beside their targets and report any
  incomplete rollback or cleanup.
• Preserve unrelated bytes, LF or CRLF style, final-newline state, and portable
  permission bits.
• Run locally without network requests or telemetry from the Multi Section
  Patch executable.

Install

Review the complete skill before installing:

gh skill preview rudra2112/multi-section-patch multi-section-patch@v0.1.0

Install the tagged release for one agent with GitHub CLI 2.91.0 or newer:

gh skill install rudra2112/multi-section-patch multi-section-patch --agent <agent-id> --scope user --pin v0.1.0

Common agent IDs are claude-code, codex, cursor, gemini-cli, and
github-copilot.

For a project-scoped installation through the third-party skills CLI, run
this from the target repository root:

npx --yes skills@1.5.19 add rudra2112/multi-section-patch --skill multi-section-patch --agent <agent-id> --yes

Use the GitHub CLI command above when the installation must remain pinned to
v0.1.0. The skills@1.5.19 installer requires Node.js 22.20.0 or newer only
during installation. Node.js is not a runtime dependency of Multi Section
Patch.

On macOS or Linux, a GitHub-based copy may not preserve executable mode bits.
If the first run reports permission denied, apply chmod +x only to the
binary matching the current OS and architecture.

See the
installation guide
for manual installation, updates, removal, and host-specific verification.

Included skill

The release contains:

• SKILL.md, the agent workflow and platform selection instructions;
• references/CLI.md, the complete selector, JSON, output, and failure
  contract;
• SHA256SUMS, covering every bundled executable;
• the MIT license; and
• six native executables.

Supported platforms

Operating system	Architecture
macOS	x86-64
macOS	ARM64
Linux	x86-64
Linux	ARM64
Windows	x86-64
Windows	ARM64

Each pair is tested on a matching native GitHub-hosted runner. Cross-compilation
alone is not treated as support.

Safety and privacy

• edit is a dry run unless --apply is present.
• Every target, selector, replacement, and guard is validated before the first
  write.
• Target identity, bytes, and applicable permissions are rechecked after
  staging and immediately before replacement.
• A later replacement failure triggers conservative reverse-order rollback.
• Selected content is treated as data and is never executed by the bundled
  command.
• Normal read and edit operations make no network requests and emit no
  telemetry.

Review SKILL.md, verify SHA256SUMS, and inspect every dry-run diff before
applying changes.

Known limitations

• Multi-file apply is staged and rollback-protected, but it is not a
  filesystem-atomic transaction.
• Inputs must be regular, valid UTF-8 text files without unsupported binary
  control bytes.
• The tool performs bounded text editing, not syntax-aware AST refactoring.
• Ownership, ACLs, extended attributes, resource forks, alternate data
  streams, and timestamps are outside the portable metadata guarantee.
• Windows read-only targets are rejected before staging.
• The binaries are not Apple Developer ID-notarized or Windows
  Authenticode-signed. Follow local security policy rather than bypassing
  platform protections.
• Hosts must support Agent Skills discovery and local process execution.

Release verification

The release candidate must pass:

• go test ./...;
• go vet ./...;
• native test and smoke jobs for all six supported platform pairs;
• two reproducible all-target builds compared byte for byte;
• validation of every entry in SHA256SUMS; and
• the enforced size budget of 3 MiB per executable and 18 MiB in total.

Security

Report suspected vulnerabilities through the repository's
private vulnerability reporting
instead of opening a public issue.