Changelog
Every published version of goflag: the CLI, the Next.js library and the share cards, on one timeline. Entries are generated from the commit history, so this page cannot drift from what actually shipped.
Pin this version
pnpm dlx @goflag/cli@0.2.18 https://example.com0.2.18
@goflag/cli
November 4, 2026
0.2.18@goflag/cli
November 4, 2026
Features
- clia protected preview can be audited, its header sent to its origin only45fea95
- clithe baseline comparison and the rule catalogue are exported0a37136
- clithe report renders as a self-contained HTML filed383837
Bug fixes
- cliChromium carries --header on every same-origin hop, through the DevTools protocol91800b3
0.2.17
@goflag/cli
November 2, 2026
0.2.17@goflag/cli
November 2, 2026
Features
- clian operator can say whether a target belongs in an index1bd292c
0.4.1
@goflag/next
November 2, 2026
0.4.1@goflag/next
November 2, 2026
Features
- nextcanonicalHostRedirect sends the other host variant to the canonical origine35018d
0.3.0
@goflag/og
November 2, 2026
0.3.0@goflag/og
November 2, 2026
Breaking changes
- og`ogIcon().render` returns a promise, so a direct caller has to await it. Next awaits a default export, so `export default icon.render` is unaffected.
Features
- oga card takes the site's fonts and can draw its accentffc0e6c
0.2.16
@goflag/cli
October 25, 2026
0.2.16@goflag/cli
October 25, 2026
Features
- clia robots.txt that keeps AI answer engines out is a warning, not a question207b1b4
- clia robots.txt that keeps an AI answer engine's search crawler out is asked about35242e0
Bug fixes
- clia robots.txt decision names the agent that chose its groupfaee9ec
- clirobots.blocks-site is silent on a Googlebot allowlist and names the agents let in5bcb156
- clithe robots rules decide for the agent their sources document, not for `*`cae495e
0.2.15
@goflag/cli
October 24, 2026
0.2.15@goflag/cli
October 24, 2026
Bug fixes
- depsupdate dependencies9e84198
Performance
- clia link to a page the crawl just fetched is not probed againf0f8e4b
- clithe crawl starts a page when a request finishes, not when its batch doesc303ad4
- clithe link scan reads the pages the crawl already parsed161b22b
Documentation
- clithe link audit's header says what the scan and the check are handed1ed7d43
Other changes
- clicanonicaliseUrl has a module of its own3e5d82e
0.2.14
@goflag/cli
October 7, 2026
0.2.14@goflag/cli
October 7, 2026
Features
- clia served llms.txt is read, and what it lists must answer and be fetchable4d73703
- clithe origin is asked for a path it cannot have, and must answer 4049f4da6f
Bug fixes
- clihttp.not-found's remedy guards the locale wherever it is readdb9e5a5
- climax-image-preview: none is not a noindex6422925
- clisitemap.orphans counts only the pages a sitemap should list8b030e3
- clisitemap.orphans stands back from sitemaps it did not read78d96c7
- clithe sitemap rules read what pages and listed URLs actually say47f94e8
Documentation
- AGENTS.md and the source catalogue agree with the pipeline130c292
- the pages say what the sitemap rules now readb3184e9
0.2.13
@goflag/cli
August 23, 2026
0.2.13@goflag/cli
August 23, 2026
Features
- clithe preview folds its routes into a treeeae780f
- clithe README quotes the renderer instead of a typistd384293
- websitethe docs can show a terminal, and two pages doca89ca2
- websitethe fingerprint has a card, with the ids computedbae4baa
- websitethe preview page has a preview847dc4e
- websitethe terminal panels render generated transcripts1dab1a0
Documentation
- the surfaces say what is true, and the plan says what happened0833c9f
0.2.12
@goflag/cli
August 16, 2026
0.2.12@goflag/cli
August 16, 2026
Features
- clia JPEG says its size too, and the probe reads it30c6ef8
- cliog.image.alt.caption — the second site earned it1a6e788
- clithe declared size of a preview image meets the real one062ba35
- clithe preview gains the locale axis and the hydration deltaa2632ce
- clithe preview shows what the catalogue cannot judge24c1d3c
Bug fixes
- cli--report is written on the run that captures a baseline50f9583
- cli--summary is refused in baseline mode rather than swallowed4a377d4
- clia deeply nested JSON-LD block no longer costs the audit the page5cfb0e4
- clia JSON report piped to another process arrives wholeb5ff798
- clithe preview survives a hostile page and refuses what it would ignore61b17c8
- releasea release is decided on the package that moved7cb9dac
- the README's version pins are held against the manifestecbe0f7
0.2.11
@goflag/cli
August 16, 2026
0.2.11@goflag/cli
August 16, 2026
Features
- clikeep the sitemap document tree, and judge what it makes judgeable92fb93e
- clilet a site be asked a question, not only told a verdict2a7cf21
- clisource hreflang.missing, and say why the other one cannot be2c0669f
- clisplit the sitemap mismatch into the half Google backs and the half it does not3b0d2fa
Bug fixes
- clistop reading `/doc/` as a locale, and prove the tree off the wirecf1bf0c
0.4.0
@goflag/next
August 16, 2026
0.4.0@goflag/next
August 16, 2026
Breaking changes
- next`routes.metadata({ image })` no longer emits `og:image:alt` derived from the page title. Pass `imageAlt` beside `image` to keep the tag; without it the tag is omitted, which is what `og.image.alt` is there to report. The title was never a valid value — the protocol asks for what is in the image and excludes a caption — and because it satisfied the presence check, no audit could ever say so.
- nextthe library declares only what it was told about an image
Features
- nextthe library declares only what it was told about an imaged5eab4c
Bug fixes
- nexta title is a caption, so it is not an og:image:alte237dc3
- nextthe test reads the first image without indexing a unionc565fac
- releasea release is decided on the package that moved7cb9dac
Documentation
- nextog:image:alt stopped defaulting, and nothing said so4f61483
0.2.0
@goflag/og
August 16, 2026
0.2.0@goflag/og
August 16, 2026
Breaking changes
- ogthe package keeps only what something calls
- ogthe package keeps only what something calls8e185ae
0.2.10
@goflag/cli
August 15, 2026
0.2.10@goflag/cli
August 15, 2026
Features
- clifind the contradictions no single artefact showse765bf3
- clijudge the sitemap, and delete the fields that pretended todb66503
- clilet a finding say how authoritative it isc46fb64
- cliprobe what the sitemap promises, without asking twice34c1713
- cliread robots.txt instead of scanning it22f2c62
0.2.9
@goflag/cli
August 15, 2026
0.2.9@goflag/cli
August 15, 2026
Features
- cliask the origin for the favicon nobody declaresf7098e5
- clijudge the file, not only the tag that points at itbe09ac9
- clijudge the icons the extraction was already collecting338a473
- clijudge the og:image, not just its absence5ab8faa
Bug fixes
- clipoliteness is owed to other people's servers, not to the originb660bdb
0.3.3
@goflag/next
August 15, 2026
0.3.3@goflag/next
August 15, 2026
Features
- nextsay the cluster in both vocabularies, and describe the card6f5fbd3
0.2.8
@goflag/cli
August 13, 2026
0.2.8@goflag/cli
August 13, 2026
Features
- clirender the help and the parser from one flag table0d38ec6
- i18ncount the translations nothing vouches for273847a
- i18npair translations from reciprocal <head> alternates too9f9cc3a
Bug fixes
- rulesfollow declared clusters in hreflang.sitemap-mismatch0f934f4
Documentation
- clidocument `goflag flags`, and guard the README's flag list7372ff0
0.2.7
@goflag/cli
August 13, 2026
0.2.7@goflag/cli
August 13, 2026
Features
- cligoflag rules — the catalogue as data, not as a copy5e56afc
- clilet the sitemap say which URLs are the same pagee9dda38
- the site reads the rule catalogue instead of copying ite07c24d
Bug fixes
- cliask a second time before calling a page unreachablea972572
- cliask ICU whether a language tag exists, not a regexb3e6f8d
- clisay when a page was judged without the browser it neededcc03dbe
Documentation
- correct what the documentation says the CLI does7bc8aeb
0.3.2
@goflag/next
August 13, 2026
0.3.2@goflag/next
August 13, 2026
Features
- nextlet a collection say which entries are one pagee7cdf90
0.3.1
@goflag/next
August 13, 2026
0.3.1@goflag/next
August 13, 2026
Documentation
- correct what the documentation says the CLI does7bc8aeb
- correct what this session's own documentation got wrong25b8c3a
0.2.6
@goflag/cli
August 12, 2026
0.2.6@goflag/cli
August 12, 2026
Bug fixes
- cliask a second time before calling a page unreachablea972572
0.2.5
@goflag/cli
August 10, 2026
0.2.5@goflag/cli
August 10, 2026
Bug fixes
- clikeep one copy of a document two URLs redirect onto445097d
0.2.4
@goflag/cli
August 10, 2026
0.2.4@goflag/cli
August 10, 2026
Bug fixes
- clireport the pages the audit meant to reach and did not8d7c2da
0.2.3
@goflag/cli
August 9, 2026
0.2.3@goflag/cli
August 9, 2026
Features
- clichoose pages by the shape of the site, not by a capdad2d78
Bug fixes
- clian unreachable sitemap is not a site without one39c9fb2
- clileave the crawl room for pages the selection never named69d2130
0.2.2
@goflag/cli
August 9, 2026
0.2.2@goflag/cli
August 9, 2026
Bug fixes
- clicreate the directory a --baseline or --report path names3489c09
0.3.0
@goflag/next
August 9, 2026
0.3.0@goflag/next
August 9, 2026
Features
- nextlet a route be declared without being listed6aa12f8
0.2.1
@goflag/cli
August 8, 2026
0.2.1@goflag/cli
August 8, 2026
Bug fixes
- i18nfold locale tags to one identity, as BCP 47 says they are7ec450f
0.2.0
@goflag/next
August 8, 2026
0.2.0@goflag/next
August 8, 2026
Breaking changes
- next`locales` refuses tags naming no real language or region; `bcp47()` returns the canonical case rather than the declared string; and `localeTags.openGraph` becomes unnecessary rather than required.
Features
- nextadd @goflag/next, the route registryc762983
- nextderive every locale form from ICU, validate against it9948f92
- nextsitemap facts per route, and robots that keeps quietbfa3dd4
Bug fixes
- nextemit the locale tag the site declared, do not re-case itde1b725
- nextthe manifest must say what npm says, not what comes nextbf32069
Documentation
- a runbook for the one step that cannot be automateda1dd9f9
0.2.0
@goflag/cli
August 6, 2026
0.2.0@goflag/cli
August 6, 2026
Breaking changes
- rulesthe exported `Rule` contract is entirely new. `check(ctx)` and `appliesTo` are gone, replaced by `evaluate(extraction)` returning a verdict, and `summary` is now `title`. Code importing the rule types from `@goflag/cli` must be updated; the CLI itself, its JSON report and its exit codes are unaffected.
Features
- cliadd --conformance and --advisories027c973
- cliadd --profile, a policy overlay over the rule set07a6d00
- rulesadd the versioned extraction model rules read instead of HTMLef3bdd8
- rulesground every rule in a cited source of truthc5c44e3
- rulesrebuild the engine on sourced descriptors155a0a1
- websitedraw the checks literally, tab installs per package manager, drop em-dashes264b4ea
- websitemake the hero a diagram of the audit, switchable per passbb1b179
- websitemake the landing scannable and stop underselling811d8b7
- websitepublish the landing page, documentation and changelogf1b330e
- websitesay everything once and let the hero cards show instead of tellf3e4de3
- websitesplit legal pages per document and refine the hero diagram38ee25f
Bug fixes
- cigive the website build the two things only CI withholdsb868a05
- cistop failing the source check on someone else's outage7b13113
- websiteclear the three high advisories the site brought in1f9595f
Documentation
- document rigor, profiles and the two new report sections3eebd53
- make the README a path from install to a gated pipeline54bfe54
- spec the sitemap/robots artefact layer and slot it as Phase G7eef112
0.1.4
@goflag/cli
August 4, 2026
0.1.4@goflag/cli
August 4, 2026
Features
- clicapture a baseline with the command that will judge itbfbebca
Bug fixes
- cirelease only when the published surface moved919b590
Documentation
- correct the README for the monorepo and the published namee50ce53
- planrecord how distribution actually shipped5315126
0.1.3
@goflag/cli
August 2, 2026
0.1.3@goflag/cli
August 2, 2026
Bug fixes
- cistop the tag pipeline dying on an override with no job left5fed36a
- distdrop the ./ from bin, which npm 11 now deletes outrightd285116
Documentation
- ogplan OG images as the remedy to a rule we already ship80348c4
- refresh AGENTS.md for the monorepo and pnpm 116f77c79
0.1.2
@goflag/cli
August 2, 2026
0.1.2@goflag/cli
August 2, 2026
Bug fixes
- cistop tag pipelines dying on a cross-project includeaeb1683
0.1.1
@goflag/cli
August 2, 2026
0.1.1@goflag/cli
August 2, 2026
Bug fixes
- cikeep playwright and its image in lockstep, and fail when they driftc637fa0
- cistop the release guard inverting itself on a matchd597fe5
- depsrebuild the lockfile under the release-age policy71cfe99
Documentation
- toolspin the deprecate command, and say why it is not a one-way doord1da97f
0.1.0
@goflag/cli
July 31, 2026
0.1.0@goflag/cli
July 31, 2026
First published version. Every entry above this one is generated from commit history; this one is written by hand, because the history before it belongs to a different tool. goflag began as a browser UI called headlint, and replaying that changelog here would document a product that no longer exists. Published as `@goflag/cli`; the command it installs is `goflag`. The bare `goflag` package name is deliberately left unclaimed for now.
Other changes
- **Broken links** — crawls the site, dedupes targets globally so a footer link on 500 pages is probed once, and checks each with `HEAD`→`GET` fallback, redirect-chain and loop detection, soft-404 and anti-bot triage.
- **Missing translations** — builds a `route × locale` matrix seeded from the sitemap, and flags routes that exist in one locale and not another, hreflang reciprocity gaps, missing `x-default`, and invalid locale tags.
- **robots.txt policy** — flags a site that forbids crawling while its pages ask to be indexed. Both cannot hold, and robots.txt wins.
- **SEO metadata** — the `<head>` mistakes that cost traffic and are invisible in a browser: missing or oversized title and description, missing or relative canonical, missing `og:title` / `og:description` / `og:image`, missing viewport, contradictory robots directives.
- `goflag <url>` audits a deployed site. `--start "pnpm start"` boots the app first and stops it afterwards, so a merge can be gated on the built output.
- `--regressions-only` with `--baseline` fails only on findings that are new, and `--max-debt` ratchets the known ones down. A gate that can never reach zero gets switched off, and a suppression file that reports green lies.
- `--json` and `--summary` produce the machine-readable report everything else is built on.
- Scope is Next.js App Router: diagnostics and fix snippets assume it.
- Translation gaps and hreflang reciprocity live outside the rule catalogue, so they carry no severity overlay of their own.
- No rule carries provenance metadata yet. Treat the length thresholds as the heuristics they are, not as specification.