n-seo 0.6.0 → 0.6.1

package/CHANGELOG.md

@@ -8,6 +8,24 @@ uses [Semantic Versioning](https://semver.org/).
 
 Nothing yet.
 
+## [0.6.1] - 2026-09-15
+
+### Fixed
+- **The daily log threw away the reason a model call failed.** The llm module
+  reported `stderr` only, but a CLI may put its failure on stdout — `claude`
+  exits 1 and writes "Failed to authenticate" there — so the log read
+  `llm: exit 1:` with nothing after the colon. Every call, cause discarded.
+  It now falls back to stdout. This is the bug that matters here: it turned a
+  one-line diagnosis into a long one, and produced a confident wrong answer
+  along the way.
+- **`doctor` reported a model command as healthy when it could not run.** The
+  check was `shutil.which`: the file exists, therefore fine. A revoked key, a
+  lapsed subscription or an unreadable credential store all leave the binary
+  exactly where it was. It now sends a trivial prompt and reports what came
+  back. Note the limitation — it reports what happens *in the environment you
+  run it in*. A stripped environment that cannot reach the system credential
+  store will fail this check while the scheduled job, which can, is fine.
+
 ## [0.6.0] - 2026-09-15
 
 ### Added
@@ -486,7 +504,8 @@ First public release.
   `n-seo upgrade` gate — without changing the reported test counts, and an
   in-place install ran those assertions against the owner's live data.
 
-[Unreleased]: https://github.com/en-dash-consulting/n-seo/compare/v0.6.0...HEAD
+[Unreleased]: https://github.com/en-dash-consulting/n-seo/compare/v0.6.1...HEAD
+[0.6.1]: https://github.com/en-dash-consulting/n-seo/compare/v0.6.0...v0.6.1
 [0.6.0]: https://github.com/en-dash-consulting/n-seo/compare/v0.5.0...v0.6.0
 [0.5.0]: https://github.com/en-dash-consulting/n-seo/compare/v0.4.1...v0.5.0
 [0.4.1]: https://github.com/en-dash-consulting/n-seo/compare/v0.4.0...v0.4.1

package/ops/doctor.py

@@ -79,6 +79,36 @@ def check_profile(cfg):
     report("OK", f"from {d}")
 
 
+def probe_llm(cmd):
+    """Actually call the model and see whether it answers.
+
+    `shutil.which` only proves a file exists. An expired OAuth session, a
+    revoked key or a missing subscription all leave the binary exactly where
+    it was, so the old check reported OK while every call in the daily run
+    failed — eleven of them, silently, because the llm module degrades rather
+    than failing the run. A green tick for something that cannot work is
+    worse than no check at all.
+
+    Returns (ok, detail). Never raises.
+    """
+    try:
+        p = subprocess.run(cmd, input="Reply with the single word: ok",
+                           capture_output=True, text=True, timeout=90, encoding="utf-8")
+    except subprocess.TimeoutExpired:
+        return False, "timed out after 90s"
+    except OSError as exc:
+        return False, str(exc)[:120]
+    if p.returncode != 0:
+        detail = (p.stderr or p.stdout or "").strip().splitlines()
+        return False, (detail[0][:160] if detail else f"exit {p.returncode}, no output")
+    out = (p.stdout or "").strip()
+    if not out:
+        # Some CLIs report an auth failure on stdout and still exit 0.
+        err = (p.stderr or "").strip().splitlines()
+        return False, (err[0][:160] if err else "exited 0 but said nothing")
+    return True, out.splitlines()[0][:60]
+
+
 def check_config():
     print("config")
     if seo_config.using_example():
@@ -301,8 +331,15 @@ def check_modules(cfg):
                 elif key == "command" and not http and not llm.get("http"):
                     report("FAIL", "llm has neither http nor command configured")
                 continue
-            report("OK" if shutil.which(cmd[0]) else "FAIL", f"llm.{key}: {cmd[0]}",
-                   "" if shutil.which(cmd[0]) else "not on PATH")
+            if not shutil.which(cmd[0]):
+                report("FAIL", f"llm.{key}: {cmd[0]}", "not on PATH")
+                continue
+            if OFFLINE:
+                report("OK", f"llm.{key}: {cmd[0]}", "on PATH — not called (offline)")
+                continue
+            ok, detail = probe_llm(cmd)
+            report("OK" if ok else "FAIL", f"llm.{key}: {raw[:48]}",
+                   detail if not ok else f"answered: {detail}")
     hn = cfg["modules"].get("hackerNews", {})
     if hn.get("enabled"):
         user = (hn.get("user") or "").strip()

package/ops/llm.py

@@ -155,7 +155,12 @@ def infer(prompt: str, fast: bool = False) -> str | None:
         print(f"  llm: {exc}", file=sys.stderr)
         return None
     if p.returncode != 0:
-        print(f"  llm: exit {p.returncode}: {p.stderr.strip()[:200]}", file=sys.stderr)
+        # Not every CLI reports its failure on stderr. `claude` exits 1 and
+        # writes "Failed to authenticate: OAuth session expired" to stdout,
+        # so logging stderr alone produced "llm: exit 1:" with nothing after
+        # it — eleven times in one run, with the reason thrown away each time.
+        detail = (p.stderr.strip() or p.stdout.strip() or "no output")
+        print(f"  llm: exit {p.returncode}: {detail[:200]}", file=sys.stderr)
         return None
     out = p.stdout.strip()
     return out or None

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "n-seo",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Agentic, local-first SEO / AEO / GEO control plane: pulls Search Console + GA4, probes your sites, and ranks the next moves. Your LLM writes the proposals; your coding agent works the queue over MCP.",
   "license": "MIT",
   "author": "En Dash Consulting (https://endash.us)",