* fix(mcp): stop breaking public OAuth clients at token refresh
The DCR shim force-upgraded every public client (token_endpoint_auth_method
"none" or omitted) to client_secret_post so Perplexity would accept the
registration response. That made the stored client confidential, so the
token endpoint demanded client authentication on every grant — and MCP
clients that discard the secret (Codex) lost their session at first token
expiry with "invalid_client: missing client_secret".
Register those clients as true public clients instead (PKCE + the
provider's grant-to-client binding secure that flow), and satisfy
Perplexity by decorating only the registration response with a placeholder
client_secret and client_secret_post. The provider skips secret validation
for public clients, so clients that send the placeholder and clients that
never store it both keep working, including on refresh.
* refactor(mcp): only rebuild DCR requests that actually change
* fix(mcp): satisfy type-aware lint in DCR shims
oxlint --type-aware rejected the Record<string, unknown> assertions used to
read untrusted DCR payloads. Parse both with loose Zod schemas instead, per
the repo's trust-boundary convention, which also replaces the hand-rolled
object guards.
* feat(skills): add beginner-seo-audit agent skill
A portable agent skill that audits a domain with OpenSEO and delivers a
one-page, plain-language HTML report for a non-SEO owner, centered on a
single do-this-week action. Ships with a frozen report template and a
docs page under Agent Skills.
* feat(skills): add starting-focus keyword step; cross-link from coach and project setup
- beginner-seo-audit now proposes a 'Where to focus first' area on healthy
sites: one research_keywords call, one theme, 3-5 winnable keywords with
what to make for each. Skipped entirely when the site is down.
- seo-coach and seo-project-setup now recommend beginner-seo-audit as the
first workflow for a beginner with an existing site.
- Docs pages updated to match.
* refactor(skills): rename beginner-seo-audit to seo-audit
Audience-neutral name; the plain-language, one-action framing moves to
the description. Docs slug, meta.json, and coach/project-setup
cross-references updated to match.
A user's #1 organic result showed as position 3-4 because rank_absolute
counts SERP features (local pack, PAA, AI overviews) as positions. Rank
tracker, keyword-research SERP list, and onboarding market snapshot now
prefer rank_group; MCP get-serp-results keeps rank_absolute since it
returns all SERP item types.
Cap crawled HTML bodies at 2 MiB before Cheerio parsing, bulk-insert
audit links on Postgres instead of per-row Hyperdrive round trips, and
raise the Worker CPU ceiling to the 5-minute paid max for link-heavy
crawl steps.
Remove the RankMovementCard (setup pitch + rank movement stats) from the
dashboard grid until the rank tracking experience gets more polish. The
overview endpoint still returns the rank summary, so restoring the card
is a small revert of this commit.
