draftgo-cli 1.0.14 → 1.0.15

package/README.md

@@ -49,6 +49,14 @@ draftgo verify --url http://localhost:3000/path --screenshot always --viewport b
 
 ## 安装与连接
 
+公开页面发布后，可单独执行匿名 SEO 验收，无需浏览器或项目连接：
+
+```bash
+draftgo verify --seo --url https://example.com/product --output json
+```
+
+检查初始 HTML、状态码、重定向、标题、描述、canonical、索引指令、robots.txt 和有界 sitemap/链接采样；结果位于 `seo_validation`。目标 URL 应为希望被索引的规范页面，noindex 会失败。警告在 `--strict` 时失败。该检查不能保证正文完整性、私有数据安全、实际收录或排名，需结合人工及站长平台验收。配置通过实时 MCP 契约发现和修改。
+
 ```bash
 npm install -g draftgo-cli
 cd /path/to/project

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "draftgo-cli",
-  "version": "1.0.14",
+  "version": "1.0.15",
   "description": "Install and manage the DraftGo skill across AI coding agents (Claude Code, Codex, Cursor, Windsurf, Antigravity, Copilot, Gemini, Kiro, Pi, ZCode).",
   "bin": {
     "draftgo": "bin/draftgo.js"
@@ -49,7 +49,7 @@
     "build:release": "node scripts/build-release.js",
     "verify:package": "node scripts/verify-package.js",
     "test": "npm run lint && npm run validate:skill && npm run verify:package && npm run test:unit && npm run test:api-key && npm run test:components && npm run test:capabilities && npm run test:worklog && npm run test:mcp && npm run test:worktree && npm run test:integration && npm run test:local && npm run test:e2e",
-    "test:unit": "node tests/unit.js",
+    "test:unit": "node tests/unit.js && node --test tests/seo.test.js",
     "test:api-key": "node --test tests/api-key.test.js",
     "test:components": "node --test tests/components.test.js",
     "test:capabilities": "node --test tests/capabilities.test.js",

package/resources/skill/manifest.json

@@ -2,7 +2,7 @@
   "schema_version": "1.0",
   "id": "draftgo",
   "name": "DraftGo 开发助手",
-  "version": "1.0.14",
+  "version": "1.0.15",
   "entry": "SKILL.md",
   "description": "以 Skill/reference 任务路由、MCP 实时发现、长正文 checkout/commit、统一验证和完成日志为边界的 DraftGo 工作流。",
   "license": "MIT",

package/resources/skill/references/delivery.md

@@ -23,6 +23,8 @@ draftgo check --remote --output json
 
 ## 统一收尾
 
+公开页面上线且需要收录时，追加 `draftgo verify --seo --url https://example.com/path --output json`。它匿名检查初始 HTTP HTML、索引指令、canonical、robots.txt、sitemap 及有界链接采样，不启动浏览器，也不携带项目凭据。查看 `seo_validation` 的错误、警告、覆盖范围；noindex 对希望收录的页面属于失败。正文完整性、私有数据暴露、内容质量与实际收录需另行核对，不能将静态检查通过写成“已收录”。SEO 配置操作始终通过实时 MCP search/describe 发现。
+
 ```bash
 draftgo verify
 draftgo work complete <ref> --note "<结果与证据>"

package/src/commands/help.js

@@ -155,7 +155,8 @@ Important flags:
   --frame <mode>           (verify) auto | top | all | <iframe-selector>.
   --token <mode>           (verify) auto | never; auto appends the configured
                            API Key to same-origin URLs as the token query parameter.
-  --screenshot <mode>      (verify) always | never; always alone captures a screenshot.
+  --seo                    (verify) Anonymous initial-HTML SEO checks; requires --url.
+  --screenshot <mode>      (verify) always | never; always alone captures a screenshot.
   --browser <name>         (verify) chromium | chrome | msedge.
   --browser-path <file>    (verify) Explicit browser executable; environment
                            fallback: DRAFTGO_BROWSER_PATH.

package/src/commands/seoVerify.js

@@ -0,0 +1,174 @@
+'use strict';
+
+const parse5 = require('parse5');
+
+function httpURL(value, base) {
+  const url = new URL(value, base);
+  if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password) throw new Error('SEO URLs must use HTTP(S) without credentials.');
+  url.hash = '';
+  return url;
+}
+
+async function request(value, method = 'GET') {
+  let url = httpURL(value);
+  const redirects = [];
+  const signal = AbortSignal.timeout(10000);
+  for (let i = 0; i <= 5; i += 1) {
+    const response = await fetch(url, { method, redirect: 'manual', signal, headers: { 'User-Agent': 'DraftGo-SEO-Verify/1.0' } });
+    if ([301, 302, 303, 307, 308].includes(response.status)) {
+      await response.body?.cancel();
+      if (i === 5) throw new Error('More than 5 redirects.');
+      const location = response.headers.get('location');
+      if (!location) throw new Error('Redirect has no Location.');
+      redirects.push({ url: url.href, status: response.status });
+      url = httpURL(location, url);
+      continue;
+    }
+    const chunks = [];
+    let size = 0;
+    if (response.body) {
+      for await (const chunk of response.body) {
+        size += chunk.length;
+        if (size > 2 * 1024 * 1024) throw new Error('Response exceeds 2 MiB.');
+        chunks.push(Buffer.from(chunk));
+      }
+    }
+    return { url: url.href, status: response.status, headers: response.headers, text: Buffer.concat(chunks).toString('utf8'), redirects };
+  }
+}
+
+function inspect(html) {
+  const result = { titles: [], descriptions: [], canonicals: [], robots: [], links: [], images: [], body: '' };
+  const text = node => node.nodeName === '#text' ? node.value : (node.childNodes || []).map(text).join(' ');
+  function walk(node, hidden = false, body = false, head = false) {
+    const attrs = Object.fromEntries((node.attrs || []).map(a => [a.name, a.value]));
+    hidden ||= ['script', 'style', 'template', 'iframe', 'noscript', 'nav', 'footer'].includes(node.tagName) || 'hidden' in attrs || attrs['aria-hidden'] === 'true';
+    body ||= node.tagName === 'body';
+    head ||= node.tagName === 'head';
+    if (head && node.tagName === 'title') result.titles.push(text(node).trim());
+    if (head && node.tagName === 'meta') {
+      const name = (attrs.name || attrs.property || '').toLowerCase();
+      if (name === 'description') result.descriptions.push(attrs.content || '');
+      if (['robots', 'googlebot', 'bingbot'].includes(name)) result.robots.push(attrs.content || '');
+      if (['og:image', 'twitter:image'].includes(name) && attrs.content) result.images.push(attrs.content);
+    }
+    if (head && node.tagName === 'link' && (attrs.rel || '').toLowerCase().split(/\s+/).includes('canonical')) result.canonicals.push(attrs.href || '');
+    if (body && !hidden && node.tagName === 'a' && attrs.href) result.links.push(attrs.href);
+    if (body && !hidden && node.nodeName === '#text') result.body += ` ${node.value}`;
+    for (const child of node.childNodes || []) walk(child, hidden, body, head);
+  }
+  walk(parse5.parse(html));
+  result.body = result.body.replace(/\s+/g, ' ').trim();
+  return result;
+}
+
+function robotsRules(source, url) {
+  const groups = [];
+  let group = null;
+  const sitemaps = [];
+  for (const line of source.split(/\r?\n/)) {
+    const match = line.replace(/#.*$/, '').match(/^\s*([^:]+):\s*(.*?)\s*$/);
+    if (!match) continue;
+    const key = match[1].toLowerCase(); const value = match[2];
+    if (key === 'sitemap') { sitemaps.push(value); continue; }
+    if (key === 'user-agent') {
+      if (!group || group.hasDirectives) { group = { agents: [], rules: [], hasDirectives: false }; groups.push(group); }
+      group.agents.push(value.toLowerCase());
+    } else if (group) {
+      group.hasDirectives = true;
+      if (['allow', 'disallow'].includes(key) && value) group.rules.push({ allow: key === 'allow', value });
+    }
+  }
+  const path = new URL(url).pathname + new URL(url).search;
+  const rules = groups.filter(g => g.agents.includes('*')).flatMap(g => g.rules).filter(rule => {
+    const end = rule.value.endsWith('$');
+    const pattern = (end ? rule.value.slice(0, -1) : rule.value).split('*').map(part => part.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('.*');
+    return new RegExp(`^${pattern}${end ? '$' : ''}`).test(path);
+  }).sort((a, b) => b.value.replace(/\*/g, '').length - a.value.replace(/\*/g, '').length || Number(b.allow) - Number(a.allow));
+  return { blocked: rules.length > 0 && !rules[0].allow, sitemaps, specific_agents: groups.some(g => g.agents.some(a => a !== '*')) };
+}
+
+function xmlLocations(source) {
+  return [...source.matchAll(/<loc(?:\s[^>]*)?>([\s\S]*?)<\/loc>/gi)].map(m => m[1].trim().replace(/&amp;/g, '&').replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&quot;/g, '"').replace(/&apos;/g, "'"));
+}
+
+async function seoVerify(input) {
+  const report = { status: 'failed', url: input, errors: [], warnings: [], checks: {}, limitations: ['Static anonymous HTTP inspection only; body completeness, private data exposure, CSS visibility, content quality, actual indexing/ranking and Core Web Vitals require separate verification.'] };
+  try {
+    const page = await request(input);
+    report.final_url = page.url; report.redirects = page.redirects;
+    report.checks.http_status = page.status;
+    if (page.status !== 200) report.errors.push(`Page returned HTTP ${page.status}; expected 200.`);
+    if (!/text\/html|application\/xhtml\+xml/i.test(page.headers.get('content-type') || '')) report.errors.push('Response is not HTML.');
+    const doc = inspect(page.text);
+    for (const [label, values] of [['title', doc.titles], ['description', doc.descriptions], ['canonical', doc.canonicals]]) {
+      report.checks[label] = values;
+      if (values.length !== 1 || !values[0].trim()) report.errors.push(`Expected one non-empty ${label}.`);
+    }
+    let canonical = page.url;
+    if (doc.canonicals.length === 1) {
+      try {
+        canonical = httpURL(doc.canonicals[0]).href;
+        if (canonical !== page.url) report.errors.push('Canonical does not match the final URL; this URL is not the canonical indexing target.');
+      } catch { report.errors.push('Canonical must be an absolute HTTP(S) URL without credentials.'); }
+    }
+    const robots = [...doc.robots, page.headers.get('x-robots-tag') || ''];
+    report.checks.robots = robots.filter(Boolean);
+    if (robots.some(value => /(?:^|[\s,:])(?:noindex|none)(?:$|[\s,;])/i.test(value))) report.errors.push('Indexing is disabled by robots directives.');
+    report.checks.body_text_characters = doc.body.length;
+    if (!doc.body) report.errors.push('Initial HTML has no readable body text.');
+    else if (doc.body.length < 80) report.warnings.push('Initial body text is short; manually confirm the main content is present.');
+    const origin = new URL(page.url).origin;
+    let sitemapURLs = [`${origin}/sitemap.xml`];
+    try {
+      const response = await request(`${origin}/robots.txt`);
+      report.checks.robots_txt_status = response.status;
+      if (response.status === 200) {
+        const rules = robotsRules(response.text, page.url);
+        if (rules.blocked) report.errors.push('robots.txt blocks this URL for the wildcard user agent.');
+        if (rules.specific_agents) report.warnings.push('robots.txt has crawler-specific rules; inspect target search-engine rules separately.');
+        if (rules.sitemaps.length) sitemapURLs = rules.sitemaps;
+      } else if (response.status !== 404) report.warnings.push(`robots.txt returned HTTP ${response.status}.`);
+    } catch (error) { report.warnings.push(`robots.txt: ${error.message}`); }
+    const seen = new Set(); let found = false; let incomplete = false;
+    while (sitemapURLs.length && seen.size < 5 && !found) {
+      const raw = sitemapURLs.shift();
+      try {
+        const url = httpURL(raw);
+        if (url.origin !== origin) { incomplete = true; continue; }
+        if (seen.has(url.href)) continue;
+        seen.add(url.href);
+        const response = await request(url.href);
+        if (response.status !== 200) { incomplete = true; report.warnings.push(`Sitemap returned HTTP ${response.status}: ${url.href}`); continue; }
+        const locations = xmlLocations(response.text);
+        if (/<sitemapindex[\s>]/i.test(response.text)) sitemapURLs.push(...locations);
+        else if (/<urlset[\s>]/i.test(response.text)) found = locations.includes(canonical);
+        else { incomplete = true; report.warnings.push(`Not a supported XML sitemap: ${url.href}`); }
+      } catch (error) { incomplete = true; report.warnings.push(`Sitemap: ${error.message}`); }
+    }
+    report.checks.sitemap = { found, checked: [...seen], complete: !incomplete && sitemapURLs.length === 0 };
+    if (!found) report.warnings.push(incomplete || sitemapURLs.length ? 'Canonical URL not found in bounded sitemap coverage; membership remains unverified.' : 'Canonical URL is absent from the checked sitemap(s).');
+    report.checks.samples = [];
+    const targets = [];
+    for (const [kind, values, limit] of [['link', doc.links, 5], ['share_image', doc.images, 2]]) {
+      const urls = new Set();
+      for (const raw of values) {
+        try { const url = httpURL(raw, page.url); if (kind === 'link' && url.origin !== origin) continue; urls.add(url.href); } catch { /* Non-HTTP links are not fetched. */ }
+      }
+      for (const url of [...urls].slice(0, limit)) targets.push({ kind, url });
+    }
+    for (const target of targets) {
+      try {
+        const response = await request(target.url, 'HEAD');
+        report.checks.samples.push({ ...target, status: response.status });
+        if (response.status < 200 || response.status >= 400) report.warnings.push(`${target.kind} HEAD returned ${response.status}: ${target.url}`);
+        else if (target.kind === 'share_image' && !/^image\//i.test(response.headers.get('content-type') || '')) report.warnings.push(`Share image has no image content type: ${target.url}`);
+      } catch (error) { report.warnings.push(`${target.kind}: ${error.message}`); }
+    }
+    report.limitations.push('Samples cover at most 5 same-origin links and 2 share images using HEAD; unsupported HEAD needs manual verification. Sitemap coverage is limited to 5 same-origin XML documents.');
+  } catch (error) { report.errors.push(error.message); }
+  report.status = report.errors.length ? 'failed' : report.warnings.length ? 'warning' : 'passed';
+  return report;
+}
+
+module.exports = { seoVerify, inspect, robotsRules, httpURL };

package/src/commands/verify.js

@@ -3,6 +3,7 @@
 const log = require('../logger');
 const check = require('./check');
 const visualVerify = require('./visualVerify');
+const { seoVerify, httpURL } = require('./seoVerify');
 const { canonicalResourceType } = require('../worktree/types');
 const fs = require('fs');
 const path = require('path');
@@ -151,6 +152,10 @@ async function verify(projectDir, positional = [], flags = {}) {
     selected = resources(positional);
     remoteMode = flags.remote ? 'always' : 'never';
     visual = visualRequest(flags, url);
+    if (flags.seo) {
+      if (!url) throw new Error('SEO verification requires --url <http(s) URL>.');
+      httpURL(url);
+    }
     if (flags.output === 'json' && visual.run) throw new Error('Visual verification does not support --output json; run the explicit visual check separately.');
   } catch (error) {
     log.err(error.message);
@@ -158,6 +163,8 @@ async function verify(projectDir, positional = [], flags = {}) {
   }
 
   if (flags.output !== 'json') log.title('draftgo verify');
+  const seo = flags.seo ? await seoVerify(url) : null;
+  const seoCode = seo && (seo.errors.length || (flags.strict && seo.warnings.length)) ? 1 : 0;
   const checkOptions = {
     output: flags.output,
     strict: flags.strict,
@@ -182,21 +189,28 @@ async function verify(projectDir, positional = [], flags = {}) {
       }
     }
     result.remote_validation.component_contracts = componentContracts;
-    const code = (result.code || componentContracts.status === 'failed') ? 1 : 0;
+    if (seo) result.seo_validation = seo;
+    const code = (result.code || componentContracts.status === 'failed' || seoCode) ? 1 : 0;
     delete result.code;
     console.log(JSON.stringify(result, null, 2));
     if (code !== 0) return code;
   } else {
+    if (seo) {
+      for (const error of seo.errors) log.err(`SEO: ${error}`);
+      for (const warning of seo.warnings) log.warn(`SEO: ${warning}`);
+      log.info(`SEO ${seo.status}: ${seo.final_url || url}; static HTTP checks only, indexing and content completeness are not guaranteed.`);
+    }
     if (flags.remote) {
       try { await verifyPageComponents(projectDir, selected); }
       catch (error) { log.err(error.message); return 1; }
     }
     const checkCode = await check(projectDir, [], checkOptions);
     if (checkCode !== 0) return checkCode;
+    if (seoCode !== 0) return seoCode;
   }
 
   if (!visual.run) {
-    if (url) log.warn('--url was provided without --screenshot always or --ui always; visual verification was skipped.');
+    if (url && !flags.seo) log.warn('--url was provided without --screenshot always or --ui always; visual verification was skipped.');
     if (flags.output !== 'json') log.ok('Local verification passed; browser and business interactions were not tested.');
     return 0;
   }