seo 0.2.8 → 0.2.10

package/PRIVACY.md

@@ -1,6 +1,6 @@
 # Privacy policy
 
-Last updated: 16 July 2026
+Last updated: 18 July 2026
 
 This policy covers the official `seo` command-line tool, library, MCP server,
 and the seoskill.dev website.
@@ -34,18 +34,46 @@ The use of information received from Google APIs follows the [Google API
 Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy),
 including its Limited Use requirements.
 
-## What stays on your machine
+## How Google data is protected
 
-The software stores project profiles, settings, OAuth tokens, caches, logs, and
-saved reports in local user directories. `seo privacy` prints the relevant
-paths and file permissions.
+The software stores project profiles, settings, OAuth tokens, cached API
+responses, logs, and saved reports in local user directories. It does not send
+Google user data to a hosted SEO account or database. Requests go directly from
+your machine to Google APIs over HTTPS.
 
 OAuth tokens use the operating system keychain when that option is enabled.
 The fallback token file and any bring-your-own OAuth client file are written
-with user-only file permissions. You are responsible for the security of your
+with user-only file permissions. Config, cache, and log directories are also
+created with user-only permissions on supported systems. `seo privacy` prints
+the relevant local paths and file permissions so you can inspect them.
+
+The local cache is not a substitute for device security or disk encryption. A
+person or process with access to your operating system account may be able to
+read local reports and caches. You are responsible for the security of your
 device, backups, shell history, exported reports, and any environment variables
 you create.
 
+## How long Google data is kept
+
+OAuth tokens remain on your machine until you run `seo auth logout` or
+`seo reset --yes`. Revoking SEO Skill from your Google Account invalidates the
+grant. You should still run `seo auth logout` if you also want to remove the
+local token record.
+
+Google Analytics and Search Console API responses are cached locally so repeat
+commands do not make the same request unnecessarily. A cached response is
+eligible for reuse for up to 24 hours. Expired cache rows are removed during
+automatic cache maintenance, which also removes cache rows older than 30 days
+and enforces local size limits. On a machine where the command is no longer
+run, expired rows may remain in the local cache file until you delete them.
+
+Run `seo cache clear --provider google-analytics` to remove cached Google
+Analytics responses immediately. Run `seo cache clear --provider gsc` to do
+the same for Search Console. Project profiles and reports that you deliberately
+save remain until you delete them with the relevant command or run
+`seo reset --yes`. The reset command removes all configuration, tokens, caches,
+logs, and saved data managed by the software.
+
 ## Network requests
 
 Commands connect directly from your machine to the services needed for the
@@ -114,11 +142,7 @@ ask it to inspect.
 No local report is shared with another person or service unless you export,
 copy, publish, or transmit it yourself.
 
-## Removing local data and Google access
-
-`seo auth logout` removes locally stored Google tokens. `seo reset --yes`
-removes local SEO configuration, tokens, caches, logs, and saved data managed by
-the tool.
+## Removing Google access
 
 You can also revoke the app from your [Google Account connections](https://myaccount.google.com/connections).
 Deleting local files does not delete data held by Google, npm, GitHub, a site

package/README.md

@@ -77,7 +77,7 @@ technical report before connecting Google.
 Running `seo help` shows the shape of the tool:
 
 ```txt
-seo v0.2.8
+seo v0.2.10
 
 Run SEO audits, find what needs fixing, and ship the changes with your agent.
 
@@ -183,7 +183,21 @@ seo analytics google report --property 123456789 --dimensions landingPage --metr
 
 ## Crawl a site
 
-Run a readable technical crawl, the base of any technical SEO audit:
+For a large or unfamiliar site, start with the sitemap health pass:
+
+```sh
+seo crawl --sitemap-url https://example.com/sitemap.xml --health --format pretty
+```
+
+This reads the sitemap, then checks each listed URL for status, redirects,
+robots decisions, network failures, and access blocks. It does not parse or
+render page bodies, join Google data, check external links, or write page and
+robots responses to the local cache. Requests begin one at a time and increase
+only after clean responses.
+
+Run the full crawl second when the health evidence points to a problem, or when
+you need metadata, canonicals, indexability, links, structured data, or page
+content:
 
 ```sh
 seo crawl https://example.com --format pretty
@@ -199,7 +213,15 @@ seo crawl-reports --compare latest --against previous
 ```
 
 Useful crawl controls include `--max-pages`, `--max-depth`, `--include`,
-`--exclude`, `--no-sitemap`, `--no-external`, and `--fail-on` for CI.
+`--exclude`, `--no-sitemap`, `--no-external`, and `--fail-on` for CI. Every
+request uses the stable versioned identity
+`SEO-Skill/<version> (+https://seoskill.dev)`.
+
+If a site denies or challenges that identity, the report keeps the HTTP status,
+provider indicators, request ID when available, and practical access guidance.
+Do not allow requests based on User-Agent alone because it can be spoofed.
+Scope any temporary exception to the audit machine source IP, required host or
+paths, and the exact blocking rule.
 
 ## Use it in CI and scripts
 
@@ -208,8 +230,8 @@ runs.
 
 ```sh
 seo report --project example --json
+seo crawl --sitemap-url https://example.com/sitemap.xml --health --format junit --output sitemap-health.xml --fail-on high
 seo crawl https://example.com --json --output crawl.json
-seo crawl https://example.com --fail-on high --json
 ```
 
 Reports keep observed data, derived findings, skipped sections, limits, and
@@ -343,6 +365,13 @@ const page = await auditPage({
   url: 'https://example.com/pricing',
 })
 
+const health = await crawlSite({
+  url: 'https://example.com',
+  mode: 'sitemap',
+  strategy: 'health',
+  sitemapUrl: 'https://example.com/sitemap.xml',
+})
+
 const crawl = await crawlSite({
   url: 'https://example.com',
   maxPages: 100,
@@ -350,6 +379,7 @@ const crawl = await crawlSite({
 })
 
 console.log(page.issues)
+console.log(health.summary, health.access)
 console.log(crawl.summary, crawl.issueGroups)
 ```