v4.16.2 — HTTP status reporting, bare hostnames

Patch release for two defects reported from production. No API change.

Both were the same class of problem: a check that looked correct and silently did the wrong thing.

Fixed

An HTTP error status was reported as "Connection failed" (#515).

requests.Response.__bool__ is ok, i.e. status_code < 400. So a perfectly valid 403 carrying a full body is falsy, and if err or not r routed it down the "no response at all" branch: the audit reported error="Connection failed" and http_status=0 for a request that had completed. The branch immediately below — written to name the status and point at a Cloudflare/WAF block — was unreachable for every status ≥ 400.

A site answering 200 to a desktop browser and 403 to a datacenter IP produced "Audit failed — Connection failed", sending users after a network problem that did not exist. Now:

  HTTP 403 — Site returned HTTP 403. Check for Cloudflare/WAF blocks or server errors.

Every URL field rejected a bare hostname (#514).

Five inputs across the audit form, the comparison page and the llms.txt generator were type="url", so the browser rejected example.com during native constraint validation — which runs before any submit handler, making JS normalisation unreachable. Every one of those fields shows a bare hostname as its placeholder, so each form refused exactly what it asked for.

Now type="text" with inputMode="url" (URL keyboard on mobile, no scheme requirement) plus a shared normalisation helper. The hostname check there carries the weight type="url" used to: prepending https:// makes new URL() accept a, ... and ftp://x.com, which are rejected with a readable message instead of a server error. Subdomains, multi-part TLDs, punycode and explicit ports still pass.

Verification

Suite: 1788 passed. In a clean venv with .[dev] only (the publish.yml condition, no fastapi): 1665 passed, 26 skipped. mypy 29 = 29 against the previous baseline — all pre-existing. twine check PASSED on wheel and sdist; 460K / 572K.

Of the 11 new tests covering the HTTP-status fix, 8 fail against the unfixed code — verified by stashing the fix, so they demonstrate the defect rather than describing it.