@rankcli/agent-runtime 0.0.20 → 0.0.21

package/dist/index.d.mts

@@ -269,6 +269,14 @@ interface AuditOptions {
      * checksLimit alone cannot unlock premium checks, regardless of its value.
      */
     premiumChecks?: PremiumChecks;
+    /**
+     * The URL the user asked to audit, when `url` is one of several pages
+     * being audited on its behalf (the CLI audits discovered pages one
+     * runFullAudit call at a time). A noindex on this page - or on the site's
+     * homepage - is an error; on any other page it's a warning. Defaults to
+     * `url` itself.
+     */
+    auditRootUrl?: string;
 }
 declare function runFullAudit(options: AuditOptions): Promise<AuditReport>;
 declare function formatReport(report: AuditReport): string;
@@ -306,8 +314,18 @@ interface OnPageData {
     textToHtmlRatio: number;
     hasNoindex: boolean;
     metaRobots?: string;
+    /** X-Robots-Tag response header value, when the caller passed headers */
+    xRobotsTag?: string;
+}
+interface OnPageOptions {
+    /**
+     * Whether this page is the root of what's being audited (the URL the user
+     * asked for). Noindex there is an error rather than a warning. Defaults to
+     * "is the URL the site's homepage".
+     */
+    auditRoot?: boolean;
 }
-declare function analyzeOnPage(html: string, url: string): {
+declare function analyzeOnPage(html: string, url: string, headers?: Record<string, string>, options?: OnPageOptions): {
     issues: AuditIssue[];
     data: OnPageData;
 };
@@ -2760,6 +2778,14 @@ interface WorkflowConfig {
 }
 /**
  * Generate GitHub Action workflow YAML
+ *
+ * RANKCLI_API_KEY is scoped to the rankcli steps only (never job- or
+ * workflow-level env, where third-party actions like create-pull-request
+ * would see it too). Every rankcli step writes JSON even when it fails,
+ * and every reader parses defensively, so one failed step can't cascade
+ * into a JSON.parse('') crash. Report files go to $RUNNER_TEMP, outside
+ * the checkout: in the workspace, create-pull-request committed them into
+ * every auto-fix PR as untracked files.
  */
 declare function generateWorkflow(config: WorkflowConfig): string;
 /**

package/dist/index.d.ts

@@ -269,6 +269,14 @@ interface AuditOptions {
      * checksLimit alone cannot unlock premium checks, regardless of its value.
      */
     premiumChecks?: PremiumChecks;
+    /**
+     * The URL the user asked to audit, when `url` is one of several pages
+     * being audited on its behalf (the CLI audits discovered pages one
+     * runFullAudit call at a time). A noindex on this page - or on the site's
+     * homepage - is an error; on any other page it's a warning. Defaults to
+     * `url` itself.
+     */
+    auditRootUrl?: string;
 }
 declare function runFullAudit(options: AuditOptions): Promise<AuditReport>;
 declare function formatReport(report: AuditReport): string;
@@ -306,8 +314,18 @@ interface OnPageData {
     textToHtmlRatio: number;
     hasNoindex: boolean;
     metaRobots?: string;
+    /** X-Robots-Tag response header value, when the caller passed headers */
+    xRobotsTag?: string;
+}
+interface OnPageOptions {
+    /**
+     * Whether this page is the root of what's being audited (the URL the user
+     * asked for). Noindex there is an error rather than a warning. Defaults to
+     * "is the URL the site's homepage".
+     */
+    auditRoot?: boolean;
 }
-declare function analyzeOnPage(html: string, url: string): {
+declare function analyzeOnPage(html: string, url: string, headers?: Record<string, string>, options?: OnPageOptions): {
     issues: AuditIssue[];
     data: OnPageData;
 };
@@ -2760,6 +2778,14 @@ interface WorkflowConfig {
 }
 /**
  * Generate GitHub Action workflow YAML
+ *
+ * RANKCLI_API_KEY is scoped to the rankcli steps only (never job- or
+ * workflow-level env, where third-party actions like create-pull-request
+ * would see it too). Every rankcli step writes JSON even when it fails,
+ * and every reader parses defensively, so one failed step can't cascade
+ * into a JSON.parse('') crash. Report files go to $RUNNER_TEMP, outside
+ * the checkout: in the workspace, create-pull-request committed them into
+ * every auto-fix PR as untracked files.
  */
 declare function generateWorkflow(config: WorkflowConfig): string;
 /**

package/dist/index.js

@@ -5866,6 +5866,15 @@ var ISSUE_DEFINITIONS = {
     impact: "Your entire site will not be indexed by search engines.",
     howToFix: "Update robots.txt to allow crawling of important pages."
   },
+  ROBOTS_TXT_SERVER_ERROR: {
+    code: "ROBOTS_TXT_SERVER_ERROR",
+    severity: "warning",
+    category: "crawlability",
+    title: "robots.txt returns a server error",
+    description: "Requesting /robots.txt returned a 5xx (or 429) status instead of the file or a 404.",
+    impact: 'Google treats a 5xx/429 robots.txt as "disallow everything" and stops crawling the whole site until it gets a real answer.',
+    howToFix: "Serve robots.txt with a 200 (or return a 404 if you have none). Check the server/CDN route for /robots.txt."
+  },
   SITEMAP_MISSING: {
     code: "SITEMAP_MISSING",
     severity: "warning",
@@ -5930,14 +5939,35 @@ var ISSUE_DEFINITIONS = {
     howToFix: "Add internal links from relevant pages to this page."
   },
   // ==================== INDEXABILITY ====================
+  // Base severity for a noindexed page other than the audited root;
+  // on-page.ts raises it to 'error' on the site root (a noindexed homepage
+  // takes the whole site out of search).
   NOINDEX_TAG: {
     code: "NOINDEX_TAG",
-    severity: "notice",
+    severity: "warning",
     category: "indexability",
-    title: "Page has noindex tag",
-    description: "The page contains a noindex meta tag or X-Robots-Tag header.",
+    title: "Page has noindex meta tag",
+    description: "The page contains a robots/googlebot meta tag with noindex (or none).",
     impact: "This page will not appear in search results.",
-    howToFix: "Remove the noindex tag if you want this page indexed."
+    howToFix: "Remove the noindex directive from the robots meta tag if you want this page indexed."
+  },
+  NOINDEX_HEADER: {
+    code: "NOINDEX_HEADER",
+    severity: "warning",
+    category: "indexability",
+    title: "Page sends X-Robots-Tag: noindex",
+    description: "The HTTP response carries an X-Robots-Tag header with noindex (or none).",
+    impact: "This page will not appear in search results, whatever the HTML says.",
+    howToFix: "Remove noindex from the X-Robots-Tag header in your server, CDN or hosting config."
+  },
+  HTTP_ERROR_STATUS: {
+    code: "HTTP_ERROR_STATUS",
+    severity: "error",
+    category: "indexability",
+    title: "Page returns an HTTP error status",
+    description: "The audited URL answered with a 4xx or 5xx status code.",
+    impact: "Search engines drop pages that return 4xx, and stop crawling pages (and eventually sites) that keep returning 5xx.",
+    howToFix: "Make the URL return 200. For a moved page use a 301 to its new address; for a server error check the application logs."
   },
   CANONICAL_MISSING: {
     code: "CANONICAL_MISSING",
@@ -8340,10 +8370,22 @@ async function checkRobotsTxt(baseUrl) {
       timeout: 1e4,
       validateStatus: () => true
     });
-    if (response.status === 404) {
+    if (response.status >= 500 || response.status === 429) {
+      issues.push({
+        ...ISSUE_DEFINITIONS.ROBOTS_TXT_SERVER_ERROR,
+        affectedUrls: [url],
+        details: { status: response.status }
+      });
+      return {
+        issues,
+        data: { exists: false, blocksAll: false, hasSitemap: false, sitemapUrls: [] }
+      };
+    }
+    if (response.status >= 400) {
       issues.push({
         ...ISSUE_DEFINITIONS.ROBOTS_TXT_MISSING,
-        affectedUrls: [url]
+        affectedUrls: [url],
+        ...response.status !== 404 && { details: { status: response.status } }
       });
       return {
         issues,
@@ -8507,14 +8549,58 @@ async function runCrawlabilityChecks(baseUrl) {
 
 // src/audit/checks/on-page.ts
 var cheerio = __toESM(require("cheerio"));
-function analyzeOnPage(html, url) {
+var PREVIEW_HOST_SUFFIXES = [".vercel.app", ".netlify.app", ".pages.dev"];
+function isPreviewDeploymentHost(hostname) {
+  const host = hostname.toLowerCase();
+  return PREVIEW_HOST_SUFFIXES.some((suffix) => host.endsWith(suffix));
+}
+function xRobotsTagHasNoindex(value) {
+  if (!value) return false;
+  const valued = /* @__PURE__ */ new Set(["unavailable_after", "max-snippet", "max-image-preview", "max-video-preview"]);
+  let agent = null;
+  for (const raw of value.toLowerCase().split(",")) {
+    let part = raw.trim();
+    const scoped = part.match(/^([a-z0-9_.*-]+)\s*:\s*(.*)$/);
+    if (scoped && !valued.has(scoped[1])) {
+      agent = scoped[1];
+      part = scoped[2].trim();
+    }
+    if (part === "noindex" || part === "none") {
+      if (agent === null || agent === "*" || agent === "googlebot" || agent === "bingbot") return true;
+    }
+  }
+  return false;
+}
+function metaHasNoindex(content) {
+  if (!content) return false;
+  return content.toLowerCase().split(",").some((d) => ["noindex", "none"].includes(d.trim()));
+}
+function isSiteRoot(url) {
+  try {
+    const u = new URL(url);
+    return (u.pathname === "/" || u.pathname === "") && !u.search;
+  } catch {
+    return false;
+  }
+}
+function analyzeOnPage(html, url, headers, options = {}) {
   const issues = [];
   const $ = cheerio.load(html);
   const title = $("title").text().trim();
   const description = $('meta[name="description"]').attr("content")?.trim();
   const canonical = $('link[rel="canonical"]').attr("href");
   const metaRobots = $('meta[name="robots"]').attr("content");
-  const hasNoindex = metaRobots?.toLowerCase().includes("noindex") || false;
+  const robotsMetaValues = [];
+  $("meta[name]").each((_, el) => {
+    const name = ($(el).attr("name") || "").toLowerCase();
+    if (name === "robots" || name === "googlebot") {
+      robotsMetaValues.push($(el).attr("content") || "");
+    }
+  });
+  const metaNoindex = robotsMetaValues.some(metaHasNoindex);
+  const headerLookup = headers ? Object.entries(headers).find(([k]) => k.toLowerCase() === "x-robots-tag")?.[1] : void 0;
+  const headerNoindex = xRobotsTagHasNoindex(headerLookup);
+  const hasNoindex = metaNoindex || headerNoindex;
   const h1s = [];
   $("h1").each((_, el) => {
     h1s.push($(el).text().trim());
@@ -8540,7 +8626,8 @@ function analyzeOnPage(html, url) {
     wordCount,
     textToHtmlRatio,
     hasNoindex,
-    metaRobots
+    metaRobots,
+    xRobotsTag: headerLookup
   };
   if (!title) {
     issues.push({
@@ -8654,11 +8741,29 @@ function analyzeOnPage(html, url) {
       details: { ratio: textToHtmlRatio.toFixed(1) + "%" }
     });
   }
-  if (hasNoindex) {
+  const root = options.auditRoot ?? isSiteRoot(url);
+  if (metaNoindex) {
     issues.push({
       ...ISSUE_DEFINITIONS.NOINDEX_TAG,
+      severity: root ? "error" : "warning",
       affectedUrls: [url],
-      details: { metaRobots }
+      details: { metaRobots: robotsMetaValues.join(", "), siteRoot: root }
+    });
+  }
+  if (headerNoindex) {
+    let preview = false;
+    try {
+      preview = isPreviewDeploymentHost(new URL(url).hostname);
+    } catch {
+    }
+    issues.push({
+      ...ISSUE_DEFINITIONS.NOINDEX_HEADER,
+      severity: preview ? "notice" : root ? "error" : "warning",
+      ...preview && {
+        description: `${ISSUE_DEFINITIONS.NOINDEX_HEADER.description} This host is a preview-deployment domain (Vercel, Netlify or Cloudflare Pages), which adds this header to non-production deployments automatically - your production domain won't send it.`
+      },
+      affectedUrls: [url],
+      details: { xRobotsTag: headerLookup, siteRoot: root, previewHost: preview }
     });
   }
   return { issues, data };
@@ -14553,7 +14658,7 @@ async function validateRobotsTxt(url) {
       timeout: 1e4,
       validateStatus: () => true
     });
-    if (response.status === 404) {
+    if (response.status >= 400) {
       return {
         issues,
         data: {
@@ -17404,8 +17509,19 @@ function analyzeTrackingVerification(html, url) {
 }
 
 // src/audit/engine.ts
+function sameUrl(a, b) {
+  try {
+    const ua = new URL(a);
+    const ub = new URL(b);
+    const path3 = (u) => u.pathname.replace(/\/+$/, "") || "/";
+    return ua.origin === ub.origin && path3(ua) === path3(ub) && ua.search === ub.search;
+  } catch {
+    return a === b;
+  }
+}
 async function runFullAudit(options) {
   const { url, checkBrokenLinks = false, checkHreflangUrls = false, checkCanonicalChain = false, cruxApiKey, checksLimit = 280, premiumChecks } = options;
+  const auditRoot = isSiteRoot(url) || sameUrl(url, options.auditRootUrl ?? url);
   const allIssues = [];
   const pages = [];
   const tier = checksLimit <= 50 ? "free" : checksLimit <= 100 ? "registered" : "paid";
@@ -17447,17 +17563,31 @@ async function runFullAudit(options) {
       affectedUrls: [url],
       details: { error: errorMsg, cause: errorCause || void 0 }
     });
-    return createReport(url, domain, allIssues, pages);
+    return createReport(url, domain, allIssues, pages, { kind: "unreachable" });
+  }
+  const statusCode = fetchResult.status;
+  if (statusCode >= 400) {
+    const blocked = statusCode === 401 || statusCode === 403 || statusCode === 429;
+    allIssues.push({
+      ...ISSUE_DEFINITIONS.HTTP_ERROR_STATUS,
+      title: `Page returns HTTP ${statusCode}`,
+      description: `The audited URL answered with HTTP ${statusCode}${fetchResult.statusText ? ` ${fetchResult.statusText}` : ""}. Page content checks were skipped - they would only be grading the error page.${blocked ? " This status often means a firewall or bot protection (Cloudflare, Vercel, etc.) is refusing automated clients: check that search engine crawlers get the page, and allowlist the RankCLI user agent or audit a preview URL." : ""}`,
+      affectedUrls: [url],
+      details: { statusCode, ...blocked && { likelyBotProtection: true } }
+    });
+    pages.push({ url, statusCode, wordCount: 0, loadTime: 0, issues: allIssues.map((i) => i.code) });
+    return createReport(url, domain, allIssues, pages, { kind: "http-error", statusCode });
   }
-  const html = fetchResult.data.replace(/<\/?noscript[^>]*>/gi, "");
+  const body = typeof fetchResult.data === "string" ? fetchResult.data : JSON.stringify(fetchResult.data ?? "");
+  const html = body.replace(/<\/?noscript[^>]*>/gi, "");
   const headers = fetchResult.headers;
   console.error(`\u{1F4DD} Phase 2: Running synchronous HTML checks (tier: ${tier}, limit: ${checksLimit})...`);
-  const onPageResult = analyzeOnPage(html, url);
+  const onPageResult = analyzeOnPage(html, url, headers, { auditRoot });
   const structuredDataResult = analyzeStructuredData(html, url);
   const mobileResult = analyzeMobile(html, url);
   const mobileResourceIssues = checkMobileResources(html, url);
   const socialResult = analyzeSocialMeta(html, url);
-  const soft404Result = detectSoft404(html, url, 200);
+  const soft404Result = detectSoft404(html, url, statusCode);
   const serpResult = analyzeSERPPreview(html, url);
   const domResult = analyzeDOMStructure(html, url);
   const techResult = detectTechnologies(html, url, headers);
@@ -17555,13 +17685,20 @@ async function runFullAudit(options) {
     }
   }
   console.error("\u{1F517} Phase 3: Running async checks (parallel)...");
+  const withTimeout = async (name, promise, timeoutMs) => {
+    let timer;
+    const timeoutPromise = new Promise((_, reject) => {
+      timer = setTimeout(() => reject(new Error(`${name} timed out`)), timeoutMs);
+    });
+    try {
+      return await Promise.race([promise, timeoutPromise]);
+    } finally {
+      clearTimeout(timer);
+    }
+  };
   const safeAsync = async (name, fn, timeoutMs = 1e4) => {
     try {
-      const resultPromise = fn();
-      const timeoutPromise = new Promise(
-        (_, reject) => setTimeout(() => reject(new Error(`${name} timed out`)), timeoutMs)
-      );
-      const result = await Promise.race([resultPromise, timeoutPromise]);
+      const result = await withTimeout(name, fn(), timeoutMs);
       return result.issues;
     } catch (err) {
       console.error(`${name} failed:`, err);
@@ -17570,11 +17707,7 @@ async function runFullAudit(options) {
   };
   const safeAsyncIssues = async (name, fn, timeoutMs = 1e4) => {
     try {
-      const resultPromise = fn();
-      const timeoutPromise = new Promise(
-        (_, reject) => setTimeout(() => reject(new Error(`${name} timed out`)), timeoutMs)
-      );
-      return await Promise.race([resultPromise, timeoutPromise]);
+      return await withTimeout(name, fn(), timeoutMs);
     } catch (err) {
       console.error(`${name} failed:`, err);
       return [];
@@ -17663,7 +17796,7 @@ async function runFullAudit(options) {
   }
   pages.push({
     url,
-    statusCode: 200,
+    statusCode,
     title: onPageResult.data.title,
     description: onPageResult.data.description,
     canonical: onPageResult.data.canonical,
@@ -17675,8 +17808,13 @@ async function runFullAudit(options) {
   console.error("\n\u2705 Audit complete!\n");
   return createReport(url, domain, allIssues, pages);
 }
-function createReport(url, domain, issues, pages) {
+function createReport(url, domain, issues, pages, pageFailure) {
   const healthScore = calculateHealthScore(issues);
+  if (pageFailure) {
+    for (const key of Object.keys(healthScore)) {
+      if (key !== "crawlability") healthScore[key] = 0;
+    }
+  }
   const errors = issues.filter((i) => i.severity === "error").length;
   const warnings = issues.filter((i) => i.severity === "warning").length;
   const notices = issues.filter((i) => i.severity === "notice").length;
@@ -17688,8 +17826,8 @@ function createReport(url, domain, issues, pages) {
     timestamp: (/* @__PURE__ */ new Date()).toISOString(),
     crawlStats: {
       totalUrls: 1,
-      crawledUrls: 1,
-      errorUrls: 0,
+      crawledUrls: pageFailure?.kind === "unreachable" ? 0 : 1,
+      errorUrls: pageFailure ? 1 : 0,
       redirectUrls: 0,
       blockedUrls: 0
     },
@@ -25164,6 +25302,16 @@ This will open a browser for OAuth consent and save tokens locally.
 // src/tracking/github-action.ts
 function generateWorkflow(config) {
   const cronSchedule = getCronSchedule(config.schedule);
+  const sync = !!config.syncToDashboard;
+  const autoFixPRs = config.features.autoFix && config.features.createPRs;
+  const keyEnv = sync ? `
+        env:
+          RANKCLI_API_KEY: \${{ secrets.RANKCLI_API_KEY }}` : "";
+  const permissions = [
+    `      contents: ${autoFixPRs ? "write" : "read"}`,
+    ...config.features.createIssues ? ["      issues: write"] : [],
+    ...autoFixPRs ? ["      pull-requests: write"] : []
+  ].join("\n");
   return `# RankCLI - Automated SEO Monitoring
 # https://rankcli.dev - generated by \`rankcli setup --github-action\`
 
@@ -25182,9 +25330,7 @@ jobs:
   seo-check:
     runs-on: ubuntu-latest
     permissions:
-      contents: write
-      issues: write
-      pull-requests: write
+${permissions}
 
     steps:
       - name: Checkout repository
@@ -25193,36 +25339,60 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '22'
 
       - name: Install RankCLI
         run: npm install -g @rankcli/cli
-${config.syncToDashboard ? `
-      - name: Log in to RankCLI
-        env:
-          RANKCLI_API_KEY: \${{ secrets.RANKCLI_API_KEY }}
-        run: rankcli login --token "$RANKCLI_API_KEY"
+${sync ? `
+      # Fails fast if the secret is missing or the key was revoked, instead
+      # of silently auditing on the Free tier.
+      - name: Verify RankCLI API key${keyEnv}
+        run: |
+          if [ -z "$RANKCLI_API_KEY" ]; then
+            echo "::error::The RANKCLI_API_KEY secret is not set - see .github/SEO_SETUP.md"
+            exit 1
+          fi
+          rankcli login
 ` : ""}
+      # Exit codes: 0 ok, 1 a gate tripped, 2 bad invocation, 3 site
+      # unreachable or the URL answered 4xx/5xx. To fail this job on SEO
+      # regressions, add gates, e.g.: --fail-on error --min-score 80
       - name: Run SEO audit
-        run: |
-          rankcli audit --url "$SITE_URL" --output json > audit-report.json
+        id: audit${keyEnv}
+        run: rankcli audit --url "$SITE_URL" --output json > "$RUNNER_TEMP/audit-report.json"
 ${config.features.createIssues ? `
       - name: Create/update SEO report issue
+        if: \${{ !cancelled() && steps.audit.outcome != 'skipped' }}
         uses: actions/github-script@v7
         with:
           script: |
             const fs = require('fs');
-            const report = JSON.parse(fs.readFileSync('audit-report.json', 'utf8'));
-            const errors = report.issues.filter(i => i.severity === 'error');
-            const warnings = report.issues.filter(i => i.severity === 'warning');
-            const notices = report.issues.filter(i => i.severity === 'notice');
+            let report = {};
+            try {
+              report = JSON.parse(fs.readFileSync(process.env.RUNNER_TEMP + '/audit-report.json', 'utf8'));
+            } catch (e) {
+              core.setFailed('audit-report.json is not valid JSON: ' + e.message);
+              return;
+            }
+            const all = report.issues || [];
+            const errors = all.filter(i => i.severity === 'error' || i.severity === 'critical');
+            const warnings = all.filter(i => i.severity === 'warning');
+            const notices = all.filter(i => i.severity === 'notice' || i.severity === 'info');
 
             const lines = [
               \`## RankCLI SEO Report\`,
               '',
-              \`**Score:** \${report.score}/100 \xB7 **Errors:** \${errors.length} \xB7 **Warnings:** \${warnings.length} \xB7 **Notices:** \${notices.length}\`,
-              '',
             ];
+            if (report.error) {
+              lines.push(\`> **Audit failed:** \${report.error}\`, '');
+            }
+            lines.push(
+              \`**Score:** \${report.score ?? 0}/100 \xB7 **Errors:** \${errors.length} \xB7 **Warnings:** \${warnings.length} \xB7 **Notices:** \${notices.length}\`,
+              '',
+            );
+            if (report.gate && !report.gate.passed) {
+              lines.push('### CI gate failed', ...report.gate.failures.map(f => \`- \${f}\`), '');
+            }
             if (errors.length > 0) {
               lines.push('### Errors', ...errors.slice(0, 15).map(i => \`- \${i.title}\`), '');
             }
@@ -25258,18 +25428,24 @@ ${config.features.createIssues ? `
                 labels: ['seo-report', 'automated'],
               });
             }
-` : ""}${config.features.autoFix && config.features.createPRs ? `
+` : ""}${autoFixPRs ? `
+      # Auto-fix needs a Solo+ plan (resolved from RANKCLI_API_KEY). It
+      # always writes JSON - appliedCount is 0 when there was nothing to fix
+      # or the plan doesn't include auto-fix.
       - name: Auto-fix issues
-        run: rankcli fix --url "$SITE_URL" --auto --output json > fixes.json
+        id: autofix
+        if: \${{ !cancelled() && steps.audit.outcome != 'skipped' }}${keyEnv}
+        run: rankcli fix --url "$SITE_URL" --auto --output json > "$RUNNER_TEMP/fixes.json"
 
       - name: Check if any fixes were applied
         id: fixes
+        if: \${{ !cancelled() && steps.autofix.outcome != 'skipped' }}
         run: |
-          APPLIED=$(node -p "JSON.parse(require('fs').readFileSync('fixes.json','utf8')).appliedCount || 0")
-          echo "applied=$APPLIED" >> $GITHUB_OUTPUT
+          APPLIED=$(node -e "let r = {}; try { r = JSON.parse(require('fs').readFileSync(process.env.RUNNER_TEMP + '/fixes.json', 'utf8')); } catch {} console.log(r.appliedCount || 0)")
+          echo "applied=$APPLIED" >> "$GITHUB_OUTPUT"
 
       - name: Create PR with fixes
-        if: steps.fixes.outputs.applied != '0'
+        if: \${{ !cancelled() && steps.fixes.outputs.applied != '' && steps.fixes.outputs.applied != '0' }}
         uses: peter-evans/create-pull-request@v6
         with:
           token: \${{ secrets.GITHUB_TOKEN }}
@@ -25288,12 +25464,14 @@ ${config.features.createIssues ? `
           labels: seo, automated
 ` : ""}
       - name: Save report artifact
+        if: \${{ !cancelled() }}
         uses: actions/upload-artifact@v4
         with:
           name: rankcli-report-\${{ github.run_number }}
           path: |
-            audit-report.json
-            ${config.features.autoFix ? "fixes.json" : ""}
+            \${{ runner.temp }}/audit-report.json${autoFixPRs ? `
+            \${{ runner.temp }}/fixes.json` : ""}
+          if-no-files-found: ignore
           retention-days: 90
 `;
 }
@@ -25326,19 +25504,20 @@ Go to your repository Settings > Secrets and variables > Actions
 ## RankCLI (required - sends audits to your dashboard)
 
 1. \`RANKCLI_API_KEY\`
-   - Get a free API key at https://rankcli.dev/account?tab=api-keys
-   - Without this secret, remove the "Log in to RankCLI" step from
-     .github/workflows/seo.yml - the audit still runs, it just won't
-     appear on your dashboard.
+   - Create one at https://rankcli.dev/account?tab=api-keys
+   - It is only passed to the RankCLI steps. The "Verify RankCLI API key"
+     step fails the run if the secret is missing or the key was revoked,
+     rather than silently auditing on the Free tier.
+   - Your plan comes from the key: auto-fix PRs need Solo or higher.
 
 `;
   } else {
     secrets += `
 No secrets are required for this workflow as configured - it runs a local
-audit and, if enabled, opens auto-fix PRs using the repository's built-in
-GITHUB_TOKEN. To also sync results to your RankCLI dashboard, re-run
-\`rankcli setup --github-action\` and opt in when asked, or add a
-\`RANKCLI_API_KEY\` secret and a \`rankcli login --token\` step yourself.
+audit and files the results as a GitHub issue using the repository's
+built-in GITHUB_TOKEN. To also sync results to your RankCLI dashboard and
+get auto-fix PRs (Solo plan or higher), re-run
+\`rankcli setup --github-action --sync\` and add a \`RANKCLI_API_KEY\` secret.
 
 `;
   }

package/dist/index.mjs

@@ -2351,6 +2351,15 @@ var ISSUE_DEFINITIONS = {
     impact: "Your entire site will not be indexed by search engines.",
     howToFix: "Update robots.txt to allow crawling of important pages."
   },
+  ROBOTS_TXT_SERVER_ERROR: {
+    code: "ROBOTS_TXT_SERVER_ERROR",
+    severity: "warning",
+    category: "crawlability",
+    title: "robots.txt returns a server error",
+    description: "Requesting /robots.txt returned a 5xx (or 429) status instead of the file or a 404.",
+    impact: 'Google treats a 5xx/429 robots.txt as "disallow everything" and stops crawling the whole site until it gets a real answer.',
+    howToFix: "Serve robots.txt with a 200 (or return a 404 if you have none). Check the server/CDN route for /robots.txt."
+  },
   SITEMAP_MISSING: {
     code: "SITEMAP_MISSING",
     severity: "warning",
@@ -2415,14 +2424,35 @@ var ISSUE_DEFINITIONS = {
     howToFix: "Add internal links from relevant pages to this page."
   },
   // ==================== INDEXABILITY ====================
+  // Base severity for a noindexed page other than the audited root;
+  // on-page.ts raises it to 'error' on the site root (a noindexed homepage
+  // takes the whole site out of search).
   NOINDEX_TAG: {
     code: "NOINDEX_TAG",
-    severity: "notice",
+    severity: "warning",
     category: "indexability",
-    title: "Page has noindex tag",
-    description: "The page contains a noindex meta tag or X-Robots-Tag header.",
+    title: "Page has noindex meta tag",
+    description: "The page contains a robots/googlebot meta tag with noindex (or none).",
     impact: "This page will not appear in search results.",
-    howToFix: "Remove the noindex tag if you want this page indexed."
+    howToFix: "Remove the noindex directive from the robots meta tag if you want this page indexed."
+  },
+  NOINDEX_HEADER: {
+    code: "NOINDEX_HEADER",
+    severity: "warning",
+    category: "indexability",
+    title: "Page sends X-Robots-Tag: noindex",
+    description: "The HTTP response carries an X-Robots-Tag header with noindex (or none).",
+    impact: "This page will not appear in search results, whatever the HTML says.",
+    howToFix: "Remove noindex from the X-Robots-Tag header in your server, CDN or hosting config."
+  },
+  HTTP_ERROR_STATUS: {
+    code: "HTTP_ERROR_STATUS",
+    severity: "error",
+    category: "indexability",
+    title: "Page returns an HTTP error status",
+    description: "The audited URL answered with a 4xx or 5xx status code.",
+    impact: "Search engines drop pages that return 4xx, and stop crawling pages (and eventually sites) that keep returning 5xx.",
+    howToFix: "Make the URL return 200. For a moved page use a 301 to its new address; for a server error check the application logs."
   },
   CANONICAL_MISSING: {
     code: "CANONICAL_MISSING",
@@ -4821,10 +4851,22 @@ async function checkRobotsTxt(baseUrl) {
       timeout: 1e4,
       validateStatus: () => true
     });
-    if (response.status === 404) {
+    if (response.status >= 500 || response.status === 429) {
+      issues.push({
+        ...ISSUE_DEFINITIONS.ROBOTS_TXT_SERVER_ERROR,
+        affectedUrls: [url],
+        details: { status: response.status }
+      });
+      return {
+        issues,
+        data: { exists: false, blocksAll: false, hasSitemap: false, sitemapUrls: [] }
+      };
+    }
+    if (response.status >= 400) {
       issues.push({
         ...ISSUE_DEFINITIONS.ROBOTS_TXT_MISSING,
-        affectedUrls: [url]
+        affectedUrls: [url],
+        ...response.status !== 404 && { details: { status: response.status } }
       });
       return {
         issues,
@@ -4988,14 +5030,58 @@ async function runCrawlabilityChecks(baseUrl) {
 
 // src/audit/checks/on-page.ts
 import * as cheerio from "cheerio";
-function analyzeOnPage(html, url) {
+var PREVIEW_HOST_SUFFIXES = [".vercel.app", ".netlify.app", ".pages.dev"];
+function isPreviewDeploymentHost(hostname) {
+  const host = hostname.toLowerCase();
+  return PREVIEW_HOST_SUFFIXES.some((suffix) => host.endsWith(suffix));
+}
+function xRobotsTagHasNoindex(value) {
+  if (!value) return false;
+  const valued = /* @__PURE__ */ new Set(["unavailable_after", "max-snippet", "max-image-preview", "max-video-preview"]);
+  let agent = null;
+  for (const raw of value.toLowerCase().split(",")) {
+    let part = raw.trim();
+    const scoped = part.match(/^([a-z0-9_.*-]+)\s*:\s*(.*)$/);
+    if (scoped && !valued.has(scoped[1])) {
+      agent = scoped[1];
+      part = scoped[2].trim();
+    }
+    if (part === "noindex" || part === "none") {
+      if (agent === null || agent === "*" || agent === "googlebot" || agent === "bingbot") return true;
+    }
+  }
+  return false;
+}
+function metaHasNoindex(content) {
+  if (!content) return false;
+  return content.toLowerCase().split(",").some((d) => ["noindex", "none"].includes(d.trim()));
+}
+function isSiteRoot(url) {
+  try {
+    const u = new URL(url);
+    return (u.pathname === "/" || u.pathname === "") && !u.search;
+  } catch {
+    return false;
+  }
+}
+function analyzeOnPage(html, url, headers, options = {}) {
   const issues = [];
   const $ = cheerio.load(html);
   const title = $("title").text().trim();
   const description = $('meta[name="description"]').attr("content")?.trim();
   const canonical = $('link[rel="canonical"]').attr("href");
   const metaRobots = $('meta[name="robots"]').attr("content");
-  const hasNoindex = metaRobots?.toLowerCase().includes("noindex") || false;
+  const robotsMetaValues = [];
+  $("meta[name]").each((_, el) => {
+    const name = ($(el).attr("name") || "").toLowerCase();
+    if (name === "robots" || name === "googlebot") {
+      robotsMetaValues.push($(el).attr("content") || "");
+    }
+  });
+  const metaNoindex = robotsMetaValues.some(metaHasNoindex);
+  const headerLookup = headers ? Object.entries(headers).find(([k]) => k.toLowerCase() === "x-robots-tag")?.[1] : void 0;
+  const headerNoindex = xRobotsTagHasNoindex(headerLookup);
+  const hasNoindex = metaNoindex || headerNoindex;
   const h1s = [];
   $("h1").each((_, el) => {
     h1s.push($(el).text().trim());
@@ -5021,7 +5107,8 @@ function analyzeOnPage(html, url) {
     wordCount,
     textToHtmlRatio,
     hasNoindex,
-    metaRobots
+    metaRobots,
+    xRobotsTag: headerLookup
   };
   if (!title) {
     issues.push({
@@ -5135,11 +5222,29 @@ function analyzeOnPage(html, url) {
       details: { ratio: textToHtmlRatio.toFixed(1) + "%" }
     });
   }
-  if (hasNoindex) {
+  const root = options.auditRoot ?? isSiteRoot(url);
+  if (metaNoindex) {
     issues.push({
       ...ISSUE_DEFINITIONS.NOINDEX_TAG,
+      severity: root ? "error" : "warning",
       affectedUrls: [url],
-      details: { metaRobots }
+      details: { metaRobots: robotsMetaValues.join(", "), siteRoot: root }
+    });
+  }
+  if (headerNoindex) {
+    let preview = false;
+    try {
+      preview = isPreviewDeploymentHost(new URL(url).hostname);
+    } catch {
+    }
+    issues.push({
+      ...ISSUE_DEFINITIONS.NOINDEX_HEADER,
+      severity: preview ? "notice" : root ? "error" : "warning",
+      ...preview && {
+        description: `${ISSUE_DEFINITIONS.NOINDEX_HEADER.description} This host is a preview-deployment domain (Vercel, Netlify or Cloudflare Pages), which adds this header to non-production deployments automatically - your production domain won't send it.`
+      },
+      affectedUrls: [url],
+      details: { xRobotsTag: headerLookup, siteRoot: root, previewHost: preview }
     });
   }
   return { issues, data };
@@ -11017,7 +11122,7 @@ async function validateRobotsTxt(url) {
       timeout: 1e4,
       validateStatus: () => true
     });
-    if (response.status === 404) {
+    if (response.status >= 400) {
       return {
         issues,
         data: {
@@ -13861,8 +13966,19 @@ function analyzeTrackingVerification(html, url) {
 }
 
 // src/audit/engine.ts
+function sameUrl(a, b) {
+  try {
+    const ua = new URL(a);
+    const ub = new URL(b);
+    const path3 = (u) => u.pathname.replace(/\/+$/, "") || "/";
+    return ua.origin === ub.origin && path3(ua) === path3(ub) && ua.search === ub.search;
+  } catch {
+    return a === b;
+  }
+}
 async function runFullAudit(options) {
   const { url, checkBrokenLinks = false, checkHreflangUrls = false, checkCanonicalChain = false, cruxApiKey, checksLimit = 280, premiumChecks } = options;
+  const auditRoot = isSiteRoot(url) || sameUrl(url, options.auditRootUrl ?? url);
   const allIssues = [];
   const pages = [];
   const tier = checksLimit <= 50 ? "free" : checksLimit <= 100 ? "registered" : "paid";
@@ -13904,17 +14020,31 @@ async function runFullAudit(options) {
       affectedUrls: [url],
       details: { error: errorMsg, cause: errorCause || void 0 }
     });
-    return createReport(url, domain, allIssues, pages);
+    return createReport(url, domain, allIssues, pages, { kind: "unreachable" });
+  }
+  const statusCode = fetchResult.status;
+  if (statusCode >= 400) {
+    const blocked = statusCode === 401 || statusCode === 403 || statusCode === 429;
+    allIssues.push({
+      ...ISSUE_DEFINITIONS.HTTP_ERROR_STATUS,
+      title: `Page returns HTTP ${statusCode}`,
+      description: `The audited URL answered with HTTP ${statusCode}${fetchResult.statusText ? ` ${fetchResult.statusText}` : ""}. Page content checks were skipped - they would only be grading the error page.${blocked ? " This status often means a firewall or bot protection (Cloudflare, Vercel, etc.) is refusing automated clients: check that search engine crawlers get the page, and allowlist the RankCLI user agent or audit a preview URL." : ""}`,
+      affectedUrls: [url],
+      details: { statusCode, ...blocked && { likelyBotProtection: true } }
+    });
+    pages.push({ url, statusCode, wordCount: 0, loadTime: 0, issues: allIssues.map((i) => i.code) });
+    return createReport(url, domain, allIssues, pages, { kind: "http-error", statusCode });
   }
-  const html = fetchResult.data.replace(/<\/?noscript[^>]*>/gi, "");
+  const body = typeof fetchResult.data === "string" ? fetchResult.data : JSON.stringify(fetchResult.data ?? "");
+  const html = body.replace(/<\/?noscript[^>]*>/gi, "");
   const headers = fetchResult.headers;
   console.error(`\u{1F4DD} Phase 2: Running synchronous HTML checks (tier: ${tier}, limit: ${checksLimit})...`);
-  const onPageResult = analyzeOnPage(html, url);
+  const onPageResult = analyzeOnPage(html, url, headers, { auditRoot });
   const structuredDataResult = analyzeStructuredData2(html, url);
   const mobileResult = analyzeMobile(html, url);
   const mobileResourceIssues = checkMobileResources(html, url);
   const socialResult = analyzeSocialMeta(html, url);
-  const soft404Result = detectSoft404(html, url, 200);
+  const soft404Result = detectSoft404(html, url, statusCode);
   const serpResult = analyzeSERPPreview(html, url);
   const domResult = analyzeDOMStructure(html, url);
   const techResult = detectTechnologies(html, url, headers);
@@ -14012,13 +14142,20 @@ async function runFullAudit(options) {
     }
   }
   console.error("\u{1F517} Phase 3: Running async checks (parallel)...");
+  const withTimeout = async (name, promise, timeoutMs) => {
+    let timer;
+    const timeoutPromise = new Promise((_, reject) => {
+      timer = setTimeout(() => reject(new Error(`${name} timed out`)), timeoutMs);
+    });
+    try {
+      return await Promise.race([promise, timeoutPromise]);
+    } finally {
+      clearTimeout(timer);
+    }
+  };
   const safeAsync = async (name, fn, timeoutMs = 1e4) => {
     try {
-      const resultPromise = fn();
-      const timeoutPromise = new Promise(
-        (_, reject) => setTimeout(() => reject(new Error(`${name} timed out`)), timeoutMs)
-      );
-      const result = await Promise.race([resultPromise, timeoutPromise]);
+      const result = await withTimeout(name, fn(), timeoutMs);
       return result.issues;
     } catch (err) {
       console.error(`${name} failed:`, err);
@@ -14027,11 +14164,7 @@ async function runFullAudit(options) {
   };
   const safeAsyncIssues = async (name, fn, timeoutMs = 1e4) => {
     try {
-      const resultPromise = fn();
-      const timeoutPromise = new Promise(
-        (_, reject) => setTimeout(() => reject(new Error(`${name} timed out`)), timeoutMs)
-      );
-      return await Promise.race([resultPromise, timeoutPromise]);
+      return await withTimeout(name, fn(), timeoutMs);
     } catch (err) {
       console.error(`${name} failed:`, err);
       return [];
@@ -14120,7 +14253,7 @@ async function runFullAudit(options) {
   }
   pages.push({
     url,
-    statusCode: 200,
+    statusCode,
     title: onPageResult.data.title,
     description: onPageResult.data.description,
     canonical: onPageResult.data.canonical,
@@ -14132,8 +14265,13 @@ async function runFullAudit(options) {
   console.error("\n\u2705 Audit complete!\n");
   return createReport(url, domain, allIssues, pages);
 }
-function createReport(url, domain, issues, pages) {
+function createReport(url, domain, issues, pages, pageFailure) {
   const healthScore = calculateHealthScore(issues);
+  if (pageFailure) {
+    for (const key of Object.keys(healthScore)) {
+      if (key !== "crawlability") healthScore[key] = 0;
+    }
+  }
   const errors = issues.filter((i) => i.severity === "error").length;
   const warnings = issues.filter((i) => i.severity === "warning").length;
   const notices = issues.filter((i) => i.severity === "notice").length;
@@ -14145,8 +14283,8 @@ function createReport(url, domain, issues, pages) {
     timestamp: (/* @__PURE__ */ new Date()).toISOString(),
     crawlStats: {
       totalUrls: 1,
-      crawledUrls: 1,
-      errorUrls: 0,
+      crawledUrls: pageFailure?.kind === "unreachable" ? 0 : 1,
+      errorUrls: pageFailure ? 1 : 0,
       redirectUrls: 0,
       blockedUrls: 0
     },
@@ -21615,6 +21753,16 @@ This will open a browser for OAuth consent and save tokens locally.
 // src/tracking/github-action.ts
 function generateWorkflow(config) {
   const cronSchedule = getCronSchedule(config.schedule);
+  const sync = !!config.syncToDashboard;
+  const autoFixPRs = config.features.autoFix && config.features.createPRs;
+  const keyEnv = sync ? `
+        env:
+          RANKCLI_API_KEY: \${{ secrets.RANKCLI_API_KEY }}` : "";
+  const permissions = [
+    `      contents: ${autoFixPRs ? "write" : "read"}`,
+    ...config.features.createIssues ? ["      issues: write"] : [],
+    ...autoFixPRs ? ["      pull-requests: write"] : []
+  ].join("\n");
   return `# RankCLI - Automated SEO Monitoring
 # https://rankcli.dev - generated by \`rankcli setup --github-action\`
 
@@ -21633,9 +21781,7 @@ jobs:
   seo-check:
     runs-on: ubuntu-latest
     permissions:
-      contents: write
-      issues: write
-      pull-requests: write
+${permissions}
 
     steps:
       - name: Checkout repository
@@ -21644,36 +21790,60 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '22'
 
       - name: Install RankCLI
         run: npm install -g @rankcli/cli
-${config.syncToDashboard ? `
-      - name: Log in to RankCLI
-        env:
-          RANKCLI_API_KEY: \${{ secrets.RANKCLI_API_KEY }}
-        run: rankcli login --token "$RANKCLI_API_KEY"
+${sync ? `
+      # Fails fast if the secret is missing or the key was revoked, instead
+      # of silently auditing on the Free tier.
+      - name: Verify RankCLI API key${keyEnv}
+        run: |
+          if [ -z "$RANKCLI_API_KEY" ]; then
+            echo "::error::The RANKCLI_API_KEY secret is not set - see .github/SEO_SETUP.md"
+            exit 1
+          fi
+          rankcli login
 ` : ""}
+      # Exit codes: 0 ok, 1 a gate tripped, 2 bad invocation, 3 site
+      # unreachable or the URL answered 4xx/5xx. To fail this job on SEO
+      # regressions, add gates, e.g.: --fail-on error --min-score 80
       - name: Run SEO audit
-        run: |
-          rankcli audit --url "$SITE_URL" --output json > audit-report.json
+        id: audit${keyEnv}
+        run: rankcli audit --url "$SITE_URL" --output json > "$RUNNER_TEMP/audit-report.json"
 ${config.features.createIssues ? `
       - name: Create/update SEO report issue
+        if: \${{ !cancelled() && steps.audit.outcome != 'skipped' }}
         uses: actions/github-script@v7
         with:
           script: |
             const fs = require('fs');
-            const report = JSON.parse(fs.readFileSync('audit-report.json', 'utf8'));
-            const errors = report.issues.filter(i => i.severity === 'error');
-            const warnings = report.issues.filter(i => i.severity === 'warning');
-            const notices = report.issues.filter(i => i.severity === 'notice');
+            let report = {};
+            try {
+              report = JSON.parse(fs.readFileSync(process.env.RUNNER_TEMP + '/audit-report.json', 'utf8'));
+            } catch (e) {
+              core.setFailed('audit-report.json is not valid JSON: ' + e.message);
+              return;
+            }
+            const all = report.issues || [];
+            const errors = all.filter(i => i.severity === 'error' || i.severity === 'critical');
+            const warnings = all.filter(i => i.severity === 'warning');
+            const notices = all.filter(i => i.severity === 'notice' || i.severity === 'info');
 
             const lines = [
               \`## RankCLI SEO Report\`,
               '',
-              \`**Score:** \${report.score}/100 \xB7 **Errors:** \${errors.length} \xB7 **Warnings:** \${warnings.length} \xB7 **Notices:** \${notices.length}\`,
-              '',
             ];
+            if (report.error) {
+              lines.push(\`> **Audit failed:** \${report.error}\`, '');
+            }
+            lines.push(
+              \`**Score:** \${report.score ?? 0}/100 \xB7 **Errors:** \${errors.length} \xB7 **Warnings:** \${warnings.length} \xB7 **Notices:** \${notices.length}\`,
+              '',
+            );
+            if (report.gate && !report.gate.passed) {
+              lines.push('### CI gate failed', ...report.gate.failures.map(f => \`- \${f}\`), '');
+            }
             if (errors.length > 0) {
               lines.push('### Errors', ...errors.slice(0, 15).map(i => \`- \${i.title}\`), '');
             }
@@ -21709,18 +21879,24 @@ ${config.features.createIssues ? `
                 labels: ['seo-report', 'automated'],
               });
             }
-` : ""}${config.features.autoFix && config.features.createPRs ? `
+` : ""}${autoFixPRs ? `
+      # Auto-fix needs a Solo+ plan (resolved from RANKCLI_API_KEY). It
+      # always writes JSON - appliedCount is 0 when there was nothing to fix
+      # or the plan doesn't include auto-fix.
       - name: Auto-fix issues
-        run: rankcli fix --url "$SITE_URL" --auto --output json > fixes.json
+        id: autofix
+        if: \${{ !cancelled() && steps.audit.outcome != 'skipped' }}${keyEnv}
+        run: rankcli fix --url "$SITE_URL" --auto --output json > "$RUNNER_TEMP/fixes.json"
 
       - name: Check if any fixes were applied
         id: fixes
+        if: \${{ !cancelled() && steps.autofix.outcome != 'skipped' }}
         run: |
-          APPLIED=$(node -p "JSON.parse(require('fs').readFileSync('fixes.json','utf8')).appliedCount || 0")
-          echo "applied=$APPLIED" >> $GITHUB_OUTPUT
+          APPLIED=$(node -e "let r = {}; try { r = JSON.parse(require('fs').readFileSync(process.env.RUNNER_TEMP + '/fixes.json', 'utf8')); } catch {} console.log(r.appliedCount || 0)")
+          echo "applied=$APPLIED" >> "$GITHUB_OUTPUT"
 
       - name: Create PR with fixes
-        if: steps.fixes.outputs.applied != '0'
+        if: \${{ !cancelled() && steps.fixes.outputs.applied != '' && steps.fixes.outputs.applied != '0' }}
         uses: peter-evans/create-pull-request@v6
         with:
           token: \${{ secrets.GITHUB_TOKEN }}
@@ -21739,12 +21915,14 @@ ${config.features.createIssues ? `
           labels: seo, automated
 ` : ""}
       - name: Save report artifact
+        if: \${{ !cancelled() }}
         uses: actions/upload-artifact@v4
         with:
           name: rankcli-report-\${{ github.run_number }}
           path: |
-            audit-report.json
-            ${config.features.autoFix ? "fixes.json" : ""}
+            \${{ runner.temp }}/audit-report.json${autoFixPRs ? `
+            \${{ runner.temp }}/fixes.json` : ""}
+          if-no-files-found: ignore
           retention-days: 90
 `;
 }
@@ -21777,19 +21955,20 @@ Go to your repository Settings > Secrets and variables > Actions
 ## RankCLI (required - sends audits to your dashboard)
 
 1. \`RANKCLI_API_KEY\`
-   - Get a free API key at https://rankcli.dev/account?tab=api-keys
-   - Without this secret, remove the "Log in to RankCLI" step from
-     .github/workflows/seo.yml - the audit still runs, it just won't
-     appear on your dashboard.
+   - Create one at https://rankcli.dev/account?tab=api-keys
+   - It is only passed to the RankCLI steps. The "Verify RankCLI API key"
+     step fails the run if the secret is missing or the key was revoked,
+     rather than silently auditing on the Free tier.
+   - Your plan comes from the key: auto-fix PRs need Solo or higher.
 
 `;
   } else {
     secrets += `
 No secrets are required for this workflow as configured - it runs a local
-audit and, if enabled, opens auto-fix PRs using the repository's built-in
-GITHUB_TOKEN. To also sync results to your RankCLI dashboard, re-run
-\`rankcli setup --github-action\` and opt in when asked, or add a
-\`RANKCLI_API_KEY\` secret and a \`rankcli login --token\` step yourself.
+audit and files the results as a GitHub issue using the repository's
+built-in GITHUB_TOKEN. To also sync results to your RankCLI dashboard and
+get auto-fix PRs (Solo plan or higher), re-run
+\`rankcli setup --github-action --sync\` and add a \`RANKCLI_API_KEY\` secret.
 
 `;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rankcli/agent-runtime",
-  "version": "0.0.20",
+  "version": "0.0.21",
   "description": "RankCLI agent runtime - executes SEO audits and fixes with AI",
   "homepage": "https://rankcli.dev",
   "main": "dist/index.js",
@@ -25,7 +25,6 @@
     "build:deno": "tsx scripts/build-deno.ts",
     "generate:recipes": "tsx scripts/generate-embedded-recipes.ts",
     "build:wasm": "tsup --config tsup.wasm.config.ts",
-    "lint": "eslint src/",
     "test": "vitest run",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage"