seo 0.2.8 → 0.2.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "seo",
-  "version": "0.2.8",
+  "version": "0.2.10",
   "description": "The only SEO skill your agent needs. 50+ SEO audit tools through a local CLI and MCP server, using your own crawl, Search Console, and Google Analytics data.",
   "type": "module",
   "license": "Apache-2.0",
@@ -74,7 +74,8 @@
     "security:check": "pnpm run security:audit && pnpm run security:secrets",
     "security:secrets": "node scripts/security-secrets.mjs",
     "skills:validate": "node scripts/validate-skills.mjs",
-    "test": "turbo run test && pnpm run build:package && node --test scripts/package.test.mjs scripts/dogfood-summary.test.mjs && pnpm run skills:validate",
+    "test": "turbo run test && pnpm run build:package && node --test scripts/package.test.mjs scripts/dogfood-summary.test.mjs && node scripts/resource-harness.mjs && node scripts/provider-resource-harness.mjs && pnpm run skills:validate",
+    "test:resources": "pnpm run build:package && node scripts/resource-harness.mjs && node scripts/provider-resource-harness.mjs",
     "test:package-install": "pnpm run build:package && node --test scripts/installed-package.test.mjs",
     "typecheck": "turbo run typecheck"
   },
@@ -106,7 +107,6 @@
     "string-width": "^7.2.0",
     "undici": "^8.7.0",
     "update-notifier": "^7.3.1",
-    "user-agents": "2.1.117",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/skills/seo/SKILL.md

@@ -38,6 +38,14 @@ response is the per-report manual: follow its `readOrder`, respect its
 `doNotClaim` limits, and use its `related` ids to decide what to run next.
 Reuse the schema for repeated runs. Do not guess parameters.
 
+When a describe response lists `fixableChecks`, the report also serves fix
+guidance per check. After a run, take each failed or warning check id from
+`topActions` and call `seo_describe_report` with `id` and `check` (CLI:
+`seo reports describe <report-id> --check <check-id>`). The result contains
+the goal, fix steps, a ready-to-use agent prompt, spec links, and a
+verification step for that one check. Fetch guidance only for checks you are
+actually going to fix.
+
 ## Setup and selection
 
 Run the `setup-check` report (or `seo doctor`) if auth state is unknown.
@@ -56,7 +64,7 @@ its evidence, then decide; do not run a whole chain blindly.
 |---|---|
 | Page not indexed or missing from Google | `index-coverage`, `index-monitor` (URL Inspection), `audit-page`, `redirect-trace` |
 | Traffic or clicks dropped | `search-performance-overview`, `traffic-anomaly`, `update-correlation`, `segment-impact`, `decaying-pages`, `link-recovery` |
-| Audit a whole site | `report` command (main report), `site-crawl`, `top-fixes`, `ai-search-scorecard` |
+| Audit a whole site | `site-crawl` with `health: true`, `report` command (main report), full `site-crawl` only if needed, `top-fixes`, `ai-search-scorecard` |
 | More clicks from existing pages | `quick-wins`, `ctr-underperformers`, `striking-distance`, `second-page`, `internal-links` |
 | AI agent readiness for a content site | `agent-readiness`, `ai-readiness`, `entity-readiness`, `llms-txt-audit` |
 | AI search visibility and eligibility | `ai-readiness`, `geo-gaps`, `ai-referrals`, `seo-to-ai-query` |
@@ -70,8 +78,25 @@ URL and an `audit-page` pass for content or technical problems on the page
 itself.
 
 The main human report is the `seo report` command. It is the right first move
-when the user asks a broad "how is my site doing" question; the focused
-reports above are for specific symptoms.
+for a broad performance question with a known project and available search
+evidence. For a broad technical audit of a large or unfamiliar URL, run the
+sitemap health pass before any full crawl. The focused reports above are for
+specific symptoms.
+
+For a large or unfamiliar site, do not open with a full crawl. Describe and run
+`site-crawl` with `health: true` and an explicit `sitemapUrl` when known. This
+first pass checks sitemap URL responses, redirects, robots decisions, and
+access blocks without downloading, parsing, rendering, or caching page bodies.
+Read `config.strategy`, `access`, failures, limits, and sitemap completeness.
+Run the full `site-crawl` second only when the question needs page content,
+metadata, canonicals, internal links, structured data, or rendered HTML.
+
+The crawler identifies every HTTP and browser request as
+`SEO-Skill/<version> (+https://seoskill.dev)`. If `access.blockedRequests` is
+non-zero, give the user the provider evidence and exact User-Agent. A
+User-Agent is spoofable, so ask for a temporary exception scoped to the audit
+machine source IP, hostname or required paths, and only the blocking security
+rule. Never recommend a broad User-Agent-only bypass.
 
 ## Evidence rules
 
@@ -97,5 +122,6 @@ The CLI also has direct commands for raw provider access and administration:
 report when one covers the question, because reports carry provenance and
 caveats that raw queries do not.
 
-Report output is cached locally. Pass `refresh: true` (or `--refresh`) only
-when the user explicitly wants a fresh fetch.
+Full report output is cached locally. Pass `refresh: true` (or `--refresh`)
+only when the user explicitly wants a fresh fetch. The sitemap health strategy
+always bypasses page-body cache and never writes page responses to it.