0.32

Croftweaver 0.32 — new helpers, and no visitor counting unless you choose it 🌱

As always: your favorite AI assistant takes you by the hand. Just ask it, in your own words, and it does the work.

What's new:

• 🌱 New sites count no visitors until you say so. On a new site, your visitors' browsers contact no analytics service at all. Want numbers? Ask your assistant to switch on Plausible. Nothing warns you if it stays off, so check once that numbers arrive.
• 🛰️ Count visitors without a script, if you prefer. Plausible can now count through Cloudflare instead, with no analytics script in your visitors' browsers. You lose a few extras, such as how far people scroll and the contact form's count. This way is new, and not yet tested with Plausible's paid cloud service. Your assistant explains both ways and walks you through the one you pick.
• 📨 See which pages bring you enquiries. With Plausible on, your site counts each click on your email address. With the usual script, it also counts each time the contact form asks the browser to open the visitor's mail program. Our counter leaves out your email address and what anyone typed. Before launch, add a goal called Email Tap in Plausible; your assistant reminds you.
• 🧭 Easier Plausible setup. Your assistant now suggests Plausible's paid cloud service, unless you already run your own Plausible server. It gives you links to the Plausible pages you need, and helps if one doesn't open.
• 🔒 A clearer privacy page. It now says what Plausible reads and sends, and how a visitor can refuse it. With no analytics, and nothing else added that needs consent, your site needs no cookie banner. With Plausible, whether it needs one is a judgment call, and your assistant says so plainly. This is not legal advice.
• 🎨 Colours and a logo, if you have none yet. A new helper writes three short requests for the design tool you like. Bring back the result, and it checks that your text colours stand out from their backgrounds, in light and dark mode. Then it puts the colours and the logo into your site. If your site's tests fail, it puts your files back and tells you if it couldn't.
• ✍️ Find the short line under your logo. Say "help me with a tagline". Your assistant finds it with you and keeps it short.
• 🔌 Install it your way. Croftweaver now comes as a plugin for Claude Code and for Codex. Or type one line, npm create croftweaver, in any terminal. The README shows each way, and how to update.
• ☁️ Cloudflare, checked and set up for you. A new checklist names the Cloudflare settings your site relies on. A check reads your live site and tells you what to change. It changes nothing itself. For a site on GitHub, your assistant can now do the setup for you. It asks for your yes before it changes anything, on setup day and again on launch day.
• 📊 See how Google and Bing show you in AI answers. Download each report and tell your assistant "here's my AI report from Google" (or Bing). Your Google & Bing page then shows the numbers. For a small site they are often empty for now, and the page says so.
• 🛠️ One thing to fix each week. Your weekly search report now suggests one small change: words people search for that the top of your page doesn't mention. Say yes, and your assistant makes the change and shows it to you first. Say no, and it waits twelve weeks before it suggests that one again.
• 🗂️ All your reports in one folder. Ask your assistant to gather your reports, downloads and checks in one analytics folder in your site's folder. It stays on your computer: your site's settings keep it off GitHub.
• 🚚 Moving from WordPress? A new helper counts your old site's posts, pages and addresses before the move. Afterwards it checks that each old address it found still leads somewhere. It only reads; it moves nothing.
• 🏡 Already have a live site? The README now lists the helpers that work on it as it is, without a rebuild.
• 🙏 One small favour. Once your site is live, your assistant asks once whether you'd add a "Built with Croftweaver" link. A no is fine, and it never asks again.
• 🔐 Safer by default. In Claude Code, new sites now block the usual commands that overwrite work on GitHub. Google's key files stay off GitHub. You can check that your download arrived intact, and the one-line installer now does that check for you. A new page lists what the helpers run and contact.
• 🔎 Sharper launch checks, and fresh building blocks. The check for leftover slots such as "[Your name]" now catches more of them. New sites build on the newest version of the site engine.

🔁 Already have a site? Nothing changes on its own. Your visitor counting stays as it is: "off" is the new start for new sites only. To pick up the rest, ask your assistant. Say: "check if my site needs any updates from the latest Croftweaver version". It compares your site with the newest template and helps you apply what changed. Some changes need asking for by name:

• "add the enquiry count from the latest template to my site" (if you use Plausible).
• "add the new lines for my .gitignore from the latest template".
• "switch my site to Plausible's server mode", if you want to count without a script. It also needs two settings in Cloudflare; your assistant walks you through them.
• If you use Plausible's usual script and the update offers new security headers, say: "keep my own analytics line in the headers". Without it, your visitor counting stops.

New here? How to start: download croftweaver.zip below, unzip it, and paste the starter prompt from the README into your AI assistant. It takes you by the hand from there. Works on macOS, Linux, WSL, and Git Bash on Windows.

0.31, a few days ago, gave the toolkit its new name. Your site stays as it is, and old links still work. What 0.30 brought is on the 0.31 page.

---

For the technically curious, 0.32:

• Analytics: the starter ships USE_ANALYTICS = false and a public/_headers with no analytics host; switching on means true, the real scriptHost/scriptId, and the host in script-src and connect-src; tests/check_analytics_gate.sh checks the builds and the headers either way, and CI tests both states. A config.ts with no USE_ANALYTICS line counts as on, so existing sites are unchanged — PR #336, PR #338. The per-site Plausible script with its init stub, and privacy pages that say what it reads, sends and stores — PR #264. Server mode: ANALYTICS.mode: 'server' plus the Production variables PLAUSIBLE_HOST and PLAUSIBLE_DOMAIN; functions/_middleware.ts sends page views to the Events API, email links go through /go/email, robots.txt disallows /go/; set the variables only with the switch on and the mode server. Q5 suggests Plausible's cloud service unless the owner already runs a Plausible server, and says Cloudflare counts no custom events — PR #343; Q5 gives Plausible's installation, settings/goals and sites/new pages as links, and the starter README and config.ts link the ones they need (seen on self-hosted Plausible; on Plausible Cloud expected, not checked) — PR #345. For an existing site, whats-new lists functions/_middleware.ts, functions/go/email.ts, tests/analytics-server.spec.ts and the gate: take the four together — PR #339; the plan's status rows after the merge — PR #344.
• Enquiry count: one "Email Tap" event from EmailLink.astro and from mail-form.js just before it hands over to the mail program; only the event name is passed. Measured once in Chromium, Firefox and WebKit, and by hand in Safari; on self-hosted Plausible CE v3.2.1 taps sent before the goal existed were counted once it was created, unlike Plausible's docs, so add the goal before launch either way. whats-new reports tests/email.spec.ts but not the site's own EmailLink.astro: take both — PR #287, PR #294, PR #298; records — PR #296, PR #306, PR #307, PR #315.
• Privacy and consent: the open-visit clause (EN and DE), from Plausible v3.2.1's session cache — PR #278; Q5's no-banner point, the DNT/GPC paragraph and the refusal sentence with its host slot — PR #330; Cloudflare's own Traffic counts as a path for owners, named in section 2 — PR #333; tests/privacy-host.spec.ts — PR #332; one slot rule shared by it and the placeholders test in tests/_helpers.ts (PLACEHOLDER_ALLOWLIST; merge _helpers.ts with both specs) — PR #337.
• *New website-brand-kit skill: palette check of 30 text/background pairs in both themes, SVG check, seven icon files, install with rollback on a failed build or test; it adds about 0.6 MB to a site, because its toolkit tests stay behind; evals 28 of 30 with the skill, 10 of 30 without; its toolkit tests stay out of sites, and a failed git read in whats-new no longer reads "Up to date" — PR #283, [PR #305]...

0.31

Croftweaver 0.31 — website-builder has a new name 🧶

As always: your favorite AI assistant takes you by the hand — just ask it, in your own words, and it does the work.

0.30 and 0.31 came out a day apart, so this page covers both: the new name first, then everything 0.30 brought.

New in 0.31:

• 🧶 website-builder is now Croftweaver. It is the same toolkit under the same free licence. Only the name is new.
• 🏠 Your site stays as it is. Nothing in a site you already built points at the old name, so there is nothing to change.
• 🔗 Old links still work. The old address on GitHub leads here. The download is now called croftweaver.zip. For this one release there is also a copy under the old name, website-builder.zip, so an old download link still gets you the newest version.
• 🧰 Got the toolkit straight from GitHub? It keeps updating as before. To tidy up, ask your assistant: "point my Croftweaver copy at its new GitHub address".
• 🔎 If you ask what changed: the update check lists three skills as changed (copywriting, search-console-insights, website-review). The only change in them is the new name.

What 0.30 brought:

• 📬 A contact form with nothing to set up. Visitors write their message, press a button, and their own email program opens with it, ready to send to you. No account, no password, no change to your domain's mail, and no bot can send through it. Every message arrives with the subject line you chose, and the visitor keeps a copy in their Sent folder. Good to know: a visitor who only reads mail in the browser may see nothing open, so your email address always shows under the form, and your site never learns whether they pressed Send. It speaks English and German, and your assistant offers it while planning your site.
• 🔎 Nothing half-finished goes live by accident. Before launch, your site's checks now read your finished pages and catch what's easy to miss: an empty slot like "[Your name]", leftover filler text, a forgotten "TODO". A new site still starts green; the legal pages remind you until they're filled in.
• 🧾 Your site stops contradicting itself. Keep one short list of the figures you stand behind: how many customers, how many countries, your satisfaction score. Ask your assistant "check our figures", and it reads every page of your live site and shows you where a number, an old name or a retired slogan no longer matches your list. It works on any website, not only one built with this toolkit.
• ⚡ Checking a change is much faster. Your site used to be built four times on every upload; now it's built once and tested once, with a short, readable result.
• 🤝 Say "merge", and your assistant does it. Until now you pressed the last button on GitHub yourself. If you work with Claude Code or Codex on your own computer, you can now just say "merge". Your assistant checks first that the tests are green, and it never merges unasked. Claude Code still asks you to confirm, unless you have allowed that command yourself.
• 🗣️ Your assistant answers in your language. Write in German, Spanish or anything else, and the reply comes in that language.
• 🔔 News comes to you. If you use Claude Code, it looks at your site's copy on GitHub at the start of a session and tells you what is new there, such as a change someone else made.
• 🏅 Show what your site gets right, if you like. A new, optional scorecard section shows visitors what your site's quality checks found, with your speed scores if you add them. Your assistant offers it; it never adds it unasked.
• 🤖 More choice for "Does AI name you?" Already have your own Gemini or Perplexity key? The weekly check can use it, including Gemini's free tier, where Google offers one. The cost shown for each run now also counts replies that were cut off or came back empty, and it says when a price is missing.
• 📚 AI-search advice that names its sources. Each figure in the advice on being named by AI assistants now links the study it comes from, or is gone. The advice on which AI robots to let in follows what OpenAI, Google, Anthropic and Perplexity say about their own robots, and your site's check now accepts a robots.txt that keeps training robots out.
• 📁 A clear home for your sites. The guide now says where to keep them: one websites folder, outside anything that syncs to iCloud or OneDrive. Your assistant asks before it starts, and tells you where your new site lives.
• 🪟 Smoother setup on Windows and inside bigger projects. A site set up inside a bigger project no longer switches off that project's own checks.
• 🔒 Fresh building blocks. New sites build on the current long-term Node version and come with three security fixes in the site's building blocks. The Google report now works with a Mac's built-in Python.
• 🛡️ Your site warns you about security holes. New sites now switch on GitHub's security alerts at setup. When a building block has a known hole, GitHub sends the fix as a ready-made change for you to accept.
• 🚀 Publishing without surprises. Cloudflare's free plan counts every visit against a daily allowance. One setting, now part of the first-publish steps, keeps your site online if that ever runs out. A site you first publish from your own computer now keeps its visitor statistics, and a site that isn't connected to GitHub gets its own publish command.
• 🇩🇪 A small fix for German legal pages. On an English site, the German legal notice now writes "[punkt]" in its email hint, not "[dot]".
• 🧹 Behind the scenes. Your assistant's second opinion on its own work keeps going when one reviewing service runs out of quota, works on older computers, says plainly why a reviewer failed, and stops sooner when there's nothing left to find.

🔁 Already have a site? Nothing changes on its own. The contact form and the scorecard are new pieces, so ask your assistant to add the one you want: "add the contact form to my site". Two settings are worth checking yourself: GitHub's security alerts (ask: "turn on the Dependabot alerts for my site, as the latest SETUP.md describes"; it may send you a fix or two right away) and Cloudflare's Fail open (ask: "walk me through Fail open for my site"). If you got the toolkit straight from GitHub (rather than as the download below), ask: "check if my site needs any updates from the latest Croftweaver version". It lists what changed and helps you apply it. It now also names pieces your site never got, such as the quick check before each upload, and your assistant puts them in place. One more for every existing site: two guides changed in ways that check can't show you, so ask once: "compare my PUBLISHING.md and SETUP.md with the latest template". And if you'd like to say "merge" on a site you already have, its AGENTS.md still says the assistant never merges, so ask: "bring the merging rule in my AGENTS.md up to date with the latest template".

New here? How to start: download croftweaver.zip below, unzip it, and paste the starter prompt from the README into your AI assistant. It takes you by the hand from there. Works on macOS, Linux, WSL, and Git Bash on Windows.

---

For the technically curious, 0.31:

• The rename: the name in prose, the repository address (karero/croftweaver; GitHub forwards the old one, and git remote set-url origin https://github.com/karero/croftweaver.git points an existing clone at the new one) and the handoff zip (dist/croftweaver.zip). The private-name check treats links to this repository as self-links under both names. Skill names, the review history and the installers' backup suffix keep the old name. Review: 3 rounds, 20 findings, no bug — PR #212.
• Docs only, since 0.30: the maintainer note on Pages or Workers records the decision to stay on Pages for now, with a comparison table — PR #261, PR #262; tracker rows closed after 0.30 — PR #260.

For the technically curious, 0.30:

• New website-contact-form skill: a mailto: form built by a same-origin script (a strict script-src 'self' holds), the address encoded as EmailLink encodes it, a required per-site subject, English and German, and a spec that checks the link the button opens; the form speaks its page's language by itself (Base.astro hands it down). The starter's EmailLink now escapes % in addresses — PR #215, PR #216.
• Rendered-placeholder test: slots, filler and TODO markers on built pages; an exemption list that only warns at launch (hard stop deferred to the publish gate) — PR #145.
• npm run verify: one build, one test run, short output, run by the pre-push hook; reinstalls only on a changed package.json or lockfile. The hook is wired by a Node script (wire-hooks.mjs), only where the site is its repo's root — PR #165, PR #149, PR #151.
• *AGENTS.md stays English, assistants reply in the person's language; scaffolds get a Claude Code SessionStart sync hook with timestamped reports, tolerant of a read-only .git, tracked by whats-new. Its first cross-model review (Codex, Kimi, a fresh-eyes Claude pass; 3 rounds, 27 findings) fixed a failed listing that used up unreported commits, failures read as "nothing new", an override of the owner's own core.sshCommand, ssh errors hiding their cause, and nagging before a site is on GitHub; the test now runs the exact settings.json command — [PR #166](https://github.co...

0.30

website-builder 0.30 — a contact form with nothing to set up, and checks that catch what you forgot 📬

As always: your favorite AI assistant takes you by the hand — just ask it, in your own words, and it does the work.

What's new:

• 📬 A contact form with nothing to set up. Visitors write their message, press a button, and their own email program opens with it, ready to send to you. No account, no password, no change to your domain's mail, and no bot can send through it. Every message arrives with the subject line you chose, and the visitor keeps a copy in their Sent folder. Good to know: a visitor who only reads mail in the browser may see nothing open, so your email address always shows under the form, and your site never learns whether they pressed Send. It speaks English and German, and your assistant offers it while planning your site.
• 🔎 Nothing half-finished goes live by accident. Before launch, your site's checks now read your finished pages and catch what's easy to miss: an empty slot like "[Your name]", leftover filler text, a forgotten "TODO". A new site still starts green; the legal pages remind you until they're filled in.
• 🧾 Your site stops contradicting itself. Keep one short list of the figures you stand behind: how many customers, how many countries, your satisfaction score. Ask your assistant "check our figures", and it reads every page of your live site and shows you where a number, an old name or a retired slogan no longer matches your list. It works on any website, not only one built with this toolkit.
• ⚡ Checking a change is much faster. Your site used to be built four times on every upload; now it's built once and tested once, with a short, readable result.
• 🤝 Say "merge", and your assistant does it. Until now you pressed the last button on GitHub yourself. If you work with Claude Code or Codex on your own computer, you can now just say "merge". Your assistant checks first that the tests are green, and it never merges unasked. Claude Code still asks you to confirm, unless you have allowed that command yourself.
• 🗣️ Your assistant answers in your language. Write in German, Spanish or anything else, and the reply comes in that language.
• 🔔 News comes to you. If you use Claude Code, it looks at your site's copy on GitHub at the start of a session and tells you what is new there, such as a change someone else made.
• 🏅 Show what your site gets right, if you like. A new, optional scorecard section shows visitors what your site's quality checks found, with your speed scores if you add them. Your assistant offers it; it never adds it unasked.
• 🤖 More choice for "Does AI name you?" Already have your own Gemini or Perplexity key? The weekly check can use it, including Gemini's free tier, where Google offers one. The cost shown for each run now also counts replies that were cut off or came back empty, and it says when a price is missing.
• 📚 AI-search advice that names its sources. Each figure in the advice on being named by AI assistants now links the study it comes from, or is gone. The advice on which AI robots to let in follows what OpenAI, Google, Anthropic and Perplexity say about their own robots, and your site's check now accepts a robots.txt that keeps training robots out.
• 📁 A clear home for your sites. The guide now says where to keep them: one websites folder, outside anything that syncs to iCloud or OneDrive. Your assistant asks before it starts, and tells you where your new site lives.
• 🪟 Smoother setup on Windows and inside bigger projects. A site set up inside a bigger project no longer switches off that project's own checks.
• 🔒 Fresh building blocks. New sites build on the current long-term Node version and come with three security fixes in the site's building blocks. The Google report now works with a Mac's built-in Python.
• 🛡️ Your site warns you about security holes. New sites now switch on GitHub's security alerts at setup. When a building block has a known hole, GitHub sends the fix as a ready-made change for you to accept.
• 🚀 Publishing without surprises. Cloudflare's free plan counts every visit against a daily allowance. One setting, now part of the first-publish steps, keeps your site online if that ever runs out. A site you first publish from your own computer now keeps its visitor statistics, and a site that isn't connected to GitHub gets its own publish command.
• 🇩🇪 A small fix for German legal pages. On an English site, the German legal notice now writes "[punkt]" in its email hint, not "[dot]".
• 🧹 Behind the scenes. Your assistant's second opinion on its own work keeps going when one reviewing service runs out of quota, works on older computers, says plainly why a reviewer failed, and stops sooner when there's nothing left to find.

🔁 Already have a site? Nothing changes on its own. The contact form and the scorecard are new pieces, so ask your assistant to add the one you want: "add the contact form to my site". Two settings are worth checking yourself: GitHub's security alerts (ask: "turn on the Dependabot alerts for my site, as the latest SETUP.md describes"; it may send you a fix or two right away) and Cloudflare's Fail open (ask: "walk me through Fail open for my site"). If you got the toolkit straight from GitHub (rather than as the download below), ask: "check if my site needs any updates from the latest website-builder version". It lists what changed and helps you apply it. It now also names pieces your site never got, such as the quick check before each upload, and your assistant puts them in place. One more for every existing site: two guides changed in ways that check can't show you, so ask once: "compare my PUBLISHING.md and SETUP.md with the latest template". And if you'd like to say "merge" on a site you already have, its AGENTS.md still says the assistant never merges, so ask: "bring the merging rule in my AGENTS.md up to date with the latest template".

📛 A new name is coming. With the next release, website-builder becomes Croftweaver. Only the name changes: your site stays as it is, and the old address will lead to the new one.

New here? How to start: download website-builder.zip below, unzip it, and paste the starter prompt from the README into your AI assistant. It takes you by the hand from there. Works on macOS, Linux, WSL, and Git Bash on Windows.

---

For the technically curious:

• New website-contact-form skill: a mailto: form built by a same-origin script (a strict script-src 'self' holds), the address encoded as EmailLink encodes it, a required per-site subject, English and German, and a spec that checks the link the button opens; the form speaks its page's language by itself (Base.astro hands it down). The starter's EmailLink now escapes % in addresses — PR #215, PR #216.
• Rendered-placeholder test: slots, filler and TODO markers on built pages; an exemption list that only warns at launch (hard stop deferred to the publish gate) — PR #145.
• npm run verify: one build, one test run, short output, run by the pre-push hook; reinstalls only on a changed package.json or lockfile. The hook is wired by a Node script (wire-hooks.mjs), only where the site is its repo's root — PR #165, PR #149, PR #151.
• AGENTS.md stays English, assistants reply in the person's language; scaffolds get a Claude Code SessionStart sync hook with timestamped reports, tolerant of a read-only .git, tracked by whats-new. Its first cross-model review (Codex, Kimi, a fresh-eyes Claude pass; 3 rounds, 27 findings) fixed a failed listing that used up unreported commits, failures read as "nothing new", an override of the owner's own core.sshCommand, ssh errors hiding their cause, and nagging before a site is on GitHub; the test now runs the exact settings.json command — PR #166, PR #175, PR #196.
• New website-scorecard skill (Lighthouse scores typed in, a stale card labelled) — PR #148.
• New facts-check skill: facts_check.py (standard library only, Python 3.9+) reads the sitemap's pages and /llms.txt, ties each number to a fact by a term after it or a phrase before it, and reports OK, OUTDATED or MISMATCH, plus retired phrases still in use; positioning rules map page paths to the term each page owns; robots.txt is respected, and a run that read no page is never reported as clean. 108 tests against a stub site, run by CI on Python 3.9 and 3.12. Its first run over the network on a large live site (240 pages) showed false ties, so the nearest fact's term now wins, whole_words is an option per fact, and more date forms are read as dates. Its commands call the script where make install links it. Review of the skill: 16 rounds — PR #230, PR #239, PR #256, PR #257, PR #258; why it took 16 — PR #240.
• *Template AGENTS.md §2: the assistant merges when the person says "merge", and only then. It re-checks the pull request first (checks, draft state, the §5 merge rule) and me...

0.29

website-builder 0.29 — one prepaid key for the weekly AI check 🔑

As always: your favorite AI assistant takes you by the hand — just ask it, in your own words, and it does the work.

0.27, 0.28 and 0.29 came out within three days, so this page covers all three: what's new in 0.29 first, then what 0.28 and 0.27 brought.

New in 0.29:

• 🔑 One key instead of four for "Does AI name you?" The weekly check can now ask ChatGPT, Claude, Gemini and Perplexity through a single OpenRouter account. You prepay once, 5 or 10 dollars or euros, and that covers the checks for weeks: a full weekly check for one site cost about $0.72 when we measured it. Each assistant still uses its own web search, so the answers are the same ones your customers get. Already have your own keys for each company? They keep working.
• 📍 Honest about one limit. Through OpenRouter, the check can't tell the assistants which country to search from. For a local business this barely matters, because its questions name the place ("bakery in Munich"). If yours don't, your assistant explains the options.
• 💶 You see what each check costs. Every weekly run shows its own total, and one assistant having a problem no longer stops the other three.
• 📈 A sturdier Google report. After 0.28, a second AI model reviewed the new "How people find you on Google" page. It now never swaps fresh numbers for older saved ones, says where saved numbers came from, and keeps working even if a settings file was edited by hand.
• 🧹 Behind the scenes. Your assistant's second opinion on its own work runs more reliably with one of the reviewing tools.

In 0.28:

• 📈 "How people find you on Google" — one page, in plain words. Ask your assistant "show me my Google report". At the top, one sentence answers "how am I doing?". Below it, week by week: how many visitors Google sent you (up to 16 months back), where you show up for the searches that matter to you, searches where you're just short of Google's first page, and pages people see but rarely click. Your Bing results are there too.
• 🤝 Numbers you can trust. The page only counts complete weeks, shows a percentage only when there are enough visitors for it to mean something, and says "not enough data yet" rather than guess. If Google can't be reached, it tells you and shows the last numbers it had, with their date.
• 🏠 It stays on your computer. The page is a single file on your own machine: nothing is uploaded. It works on a phone and in dark mode, every chart also comes as a table, and the weekly check keeps it up to date. It links to your "Does AI name you?" report, and back.
• 🧹 Behind the scenes. The built-in checks now also run on a Mac with its own standard tools, and from the unpacked download itself. The privacy check, which keeps personal names out of the toolkit, now also runs where the work is actually done.

In 0.27:

• 📖 Your home page can tell your customer's story. A new, optional step turns your home page into a short story: your customer, the problem they have, how you help, three simple steps, and what life looks like afterwards. Your assistant offers it once, right after you've worked out what makes you different, and never does it unasked.
• 🤖 "Does AI name you?" — a weekly check. Find out whether ChatGPT, Gemini, Claude, Perplexity or Google's AI answers mention your business when someone asks the kind of question your customers ask. It shows what each one knows about you from memory and what it finds when it searches the web, keeps every answer, and shows how things change week by week. Every assistant is optional and uses your own accounts; your assistant helps you set up one at a time, starting with a free one.
• 📊 A report you can actually read. Just ask "Show me my AI report for example.com". One plain answer at the top, a simple ✓ / ◐ / ✗ table per question, and the full answers tucked away for when you want them.
• 👥 Ready for a team. When a colleague or partner joins, a new guided step sets them up: the invitation, the right settings, and a one-page guide for them. Every new site also comes with one shared rulebook that all AI assistants follow, so nobody overwrites anybody.
• 🔐 Your website is yours — keep it that way. When you set up your accounts, your assistant now explains that they and your website belong to you, and recommends signing in with a second step, like your fingerprint, face or phone, so a stolen password alone can't get anyone in. It's a recommendation, not a requirement.
• 🔀 Your real address gets the credit. Once your site is live, anyone who lands on its temporary address is sent to your real domain, so AI answers point people to the right place. It stays off until you switch it on at launch; your assistant knows the steps.
• ⏩ Tidying up is quick again. Removing a finished piece of work no longer runs the whole build-and-test check first.
• 🔒 Fresh building blocks. Your site's building blocks are updated to their latest versions, including a security fix.
• 🧹 Behind the scenes. Sturdier built-in checks that now also run cleanly on a Mac, and a more thorough way for your assistant to get a second opinion on its own work.

🔁 Already have a site? Nothing changes on its own. If you run the weekly check, your Google page from 0.28 appears after its next run. Your weekly AI check keeps using the keys you set up. To switch, ask your assistant: "set up OpenRouter for my AI check". Once its key is added, it's used for all four assistants. If you got the toolkit straight from GitHub (rather than as the download below), ask: "check if my site needs any updates from the latest website-builder version". It lists what changed and helps you apply it.

New here? How to start: download website-builder.zip below, unzip it, and paste the starter prompt from the README into your AI assistant. It takes you by the hand from there. Works on macOS, Linux, WSL, and Git Bash on Windows.

---

For the technically curious — 0.29:

• geo_check.py: OpenRouter is the default route when GEO_OPENROUTER_API_KEY is set (direct keys are the fallback). It uses native provider search (plugins: [{"id": "web", "engine": "native"}]), and Sonar gets no plugin because it always searches. max_tokens is 4000. Run cost comes from usage.cost, including billed cut-off and empty replies. 401/402 stop the whole route; other errors stop only the one model. 408 and 429 are retried. A route switch is marked in the trend, and rows from before the route column count as "direct". Real OpenRouter replies are included as fixtures. Review: 2 rounds, 25 findings; the country limit is accepted as documented — PR #135.
• search_report.py: google-data.json is saved only after a successful fetch, and a failed save keeps the fresh page. Saved data records its key-search source (from). pick_property normalizes the domain, and hand-edited site records are type-checked. 6 new tests. These fixes come from an ollama-cloud read of #141 (20 findings, 6 held up); the fix itself had 1 review round with 14 findings — PR #144.
• independent-review: Antigravity gets its own prompt (PROMPT_AGY), no longer the text-only "You have NO tools" one, which made headless runs end on a refused tool call — PR #143.

For the technically curious — 0.28:

• New search-console-insights/scripts/search_report.py <domain>: writes ~/.config/gsc-insights/reports/<site>/google.html and google-data.json (the last successful fetch). Monday–Sunday weeks in Pacific Time ending before the API's firstIncompleteDate, impression-weighted weekly positions, one ["date","query"] request per key search, moves only with ≥2 usable weeks per side, a headline percentage only with ≥20 visits on both sides. track.sh records the settings it resolved in sites/<site>.json (never the Bing key) and builds the page after the AI check; geo_check.py's page links to it. 48 new tests. Plan: 7 Codex rounds + a final full read; code: 9 Codex rounds; two live runs on a real site — PR #141.
• CI job macos-stock-tools: make smoke under /bin/bash 3.2 and BSD awk/sed/tr/grep with a UTF-8 locale, asserted before it runs — PR #140.
• check_clean.sh reads the main checkout's gitignored name list from a linked worktree (it silently skipped it there) and accepts karero/website-builder#N; check_cdpath_safe.sh skips whats-new.sh loudly outside a git clone, so make check passes in the unzipped zip (it failed in v0.27's); new scripts/test_clean_denylist.sh and a macOS CI step running make check inside the unzipped zip — PR #142.

For the technically curious — 0.27:

• New website-story skill: STORY.md template, a seven-section home page map, an opt-in tests/story.spec.ts that compares the CTA's resolved URL (scheme, origin, path, hash), evals; offered once from new-website §2a — PR #133, PR #137, PR #139.
• GEO check in search-console-insights: "Knows you" / "Finds you" per engine, counted in code, drift check, --report; track.sh runs every step and ends with a needs-attention list — PR #121, PR #122.
• *AGENTS.md + CLAUDE.md in every scaffold and the website-team-setup skill; CI turns red on [MISSING: …] placeholders. The skill's evals ran for the first t...

0.28

website-builder 0.28 — see how people find you on Google 📈

As always: your favorite AI assistant takes you by the hand — just ask it, in your own words, and it does the work.

0.27 came out earlier today, so this page covers both: what's new in 0.28 first, then everything 0.27 brought.

New in 0.28:

• 📈 "How people find you on Google" — one page, in plain words. Ask your assistant "show me my Google report". At the top, one sentence answers "how am I doing?". Below it, week by week: how many visitors Google sent you (up to 16 months back), where you show up for the searches that matter to you, searches where you're just short of Google's first page, and pages people see but rarely click. Your Bing results are there too.
• 🤝 Numbers you can trust. The page only counts complete weeks, shows a percentage only when there are enough visitors for it to mean something, and says "not enough data yet" rather than guess. If Google can't be reached, it tells you and shows the last numbers it had, with their date.
• 🏠 It stays on your computer. The page is a single file on your own machine: nothing is uploaded. It works on a phone and in dark mode, every chart also comes as a table, and the weekly check keeps it up to date. It links to your "Does AI name you?" report, and back.
• 🧹 Behind the scenes. The built-in checks now also run on a Mac with its own standard tools, and from the unpacked download itself. The privacy check, which keeps personal names out of the toolkit, now also runs where the work is actually done.

In 0.27:

• 📖 Your home page can tell your customer's story. A new, optional step turns your home page into a short story: your customer, the problem they have, how you help, three simple steps, and what life looks like afterwards. Your assistant offers it once, right after you've worked out what makes you different, and never does it unasked.
• 🤖 "Does AI name you?" — a weekly check. Find out whether ChatGPT, Gemini, Claude, Perplexity or Google's AI answers mention your business when someone asks the kind of question your customers ask. It shows what each one knows about you from memory and what it finds when it searches the web, keeps every answer, and shows how things change week by week. Every assistant is optional and uses your own accounts; your assistant helps you set up one at a time, starting with a free one.
• 📊 A report you can actually read. Just ask "Show me my AI report for example.com". One plain answer at the top, a simple ✓ / ◐ / ✗ table per question, and the full answers tucked away for when you want them.
• 👥 Ready for a team. When a colleague or partner joins, a new guided step sets them up: the invitation, the right settings, and a one-page guide for them. Every new site also comes with one shared rulebook that all AI assistants follow, so nobody overwrites anybody.
• 🔐 Your website is yours — keep it that way. When you set up your accounts, your assistant now explains that they and your website belong to you, and recommends signing in with a second step, like your fingerprint, face or phone, so a stolen password alone can't get anyone in. It's a recommendation, not a requirement.
• 🔀 Your real address gets the credit. Once your site is live, anyone who lands on its temporary address is sent to your real domain, so AI answers point people to the right place. It stays off until you switch it on at launch; your assistant knows the steps.
• ⏩ Tidying up is quick again. Removing a finished piece of work no longer runs the whole build-and-test check first.
• 🔒 Fresh building blocks. Your site's building blocks are updated to their latest versions, including a security fix.
• 🧹 Behind the scenes. Sturdier built-in checks that now also run cleanly on a Mac, and a more thorough way for your assistant to get a second opinion on its own work.

🔁 Already have a site? Nothing changes on its own. If you already run the weekly check, your Google page appears after its next run. If you got the toolkit straight from GitHub (rather than as the download below), ask your assistant: "check if my site needs any updates from the latest website-builder version" — it lists what changed and helps you apply it.

New here? How to start: download website-builder.zip below, unzip it, and paste the starter prompt from the README into your AI assistant — it takes you by the hand from there. Works on macOS, Linux, WSL, and Git Bash on Windows.

---

For the technically curious — 0.28:

• New search-console-insights/scripts/search_report.py <domain>: writes ~/.config/gsc-insights/reports/<site>/google.html and google-data.json (the last successful fetch). Monday–Sunday weeks in Pacific Time ending before the API's firstIncompleteDate, impression-weighted weekly positions, one ["date","query"] request per key search, moves only with ≥2 usable weeks per side, a headline percentage only with ≥20 visits on both sides. track.sh records the settings it resolved in sites/<site>.json (never the Bing key) and builds the page after the AI check; geo_check.py's page links to it. 48 new tests. Plan: 7 Codex rounds + a final full read; code: 9 Codex rounds; two live runs on a real site — PR #141.
• CI job macos-stock-tools: make smoke under /bin/bash 3.2 and BSD awk/sed/tr/grep with a UTF-8 locale, asserted before it runs — PR #140.
• check_clean.sh reads the main checkout's gitignored name list from a linked worktree (it silently skipped it there) and accepts karero/website-builder#N; check_cdpath_safe.sh skips whats-new.sh loudly outside a git clone, so make check passes in the unzipped zip (it failed in v0.27's); new scripts/test_clean_denylist.sh and a macOS CI step running make check inside the unzipped zip — PR #142.

For the technically curious — 0.27:

• New website-story skill: STORY.md template, a seven-section home page map, an opt-in tests/story.spec.ts that compares the CTA's resolved URL (scheme, origin, path, hash), evals; offered once from new-website §2a — PR #133, PR #137, PR #139.
• GEO check in search-console-insights: "Knows you" / "Finds you" per engine, counted in code, drift check, --report; track.sh runs every step and ends with a needs-attention list — PR #121, PR #122.
• AGENTS.md + CLAUDE.md in every scaffold and the website-team-setup skill; CI turns red on [MISSING: …] placeholders. The skill's evals ran for the first time (plan-only, 21/22 with vs 9/22 without) and two broken steps were fixed — PR #111, PR #120, PR #124, PR #139.
• Two-factor / passkey recommendation for GitHub and Cloudflare in README, GETTING-STARTED, SETUP.md, new-website and website-team-setup; never required unless the provider requires it — PR #139.
• functions/_middleware.ts 301-redirects the exact production <project>.pages.dev host once CANONICAL_URL is set; previews keep noindex — PR #118.
• The template's pre-push hook exits 0 for a delete-only push, tested under bash, sh and dash (tests now assert exit status) — PR #125, PR #139.
• Template dependencies refreshed in range (astro 7.3.5, devalue 5.9.4 for GHSA-9rgm-9g3h-6x36, svgo 4.1.0) — PR #112, PR #103.
• independent-review: review depth, parallel tiers, review_log.sh with gate ids, claims sweep, round budget, merge links, --seat, Codex run outside the repo, --hidethinking for ollama, full process-tree stop — PR #106, PR #110, PR #113–#117, PR #126, PR #128, PR #132, PR #136, PR #138, PR #139.
• Suite guards: CDPATH-safe script self-location, a fail-safe pipefail early-exit-pipe guard, pipefail status fixes in package.sh and friends, a packaged-zip leak test, a secret-pattern self-test; macOS bash 3.2 / BSD-tool compatibility, and make check inside an enclosing git repo — PR #119, PR #123, PR #127, PR #129–#131, PR #139.
• *Every PR since 0.26 without a Codex review was reviewed by Codex + ollama-cloud before 0.27; trail in docs/reviews/REVIEW-diff-2026-09-27-pre-release-v027.md — [PR #139](https://g...

0.27

website-builder 0.27 — tell your story, see whether AI names you, and build as a team 📖

As always: your favorite AI assistant takes you by the hand — just ask it, in your own words, and it does the work.

What's new:

• 📖 Your home page can tell your customer's story. A new, optional step turns your home page into a short story: your customer, the problem they have, how you help, three simple steps, and what life looks like afterwards. Your assistant offers it once, right after you've worked out what makes you different, and never does it unasked.
• 🤖 "Does AI name you?" — a weekly check. Find out whether ChatGPT, Gemini, Claude, Perplexity or Google's AI answers mention your business when someone asks the kind of question your customers ask. It shows what each one knows about you from memory and what it finds when it searches the web, keeps every answer, and shows how things change week by week. Every assistant is optional and uses your own accounts; your assistant helps you set up one at a time, starting with a free one.
• 📊 A report you can actually read. Just ask "Show me my AI report for example.com". One plain answer at the top, a simple ✓ / ◐ / ✗ table per question, and the full answers tucked away for when you want them.
• 👥 Ready for a team. When a colleague or partner joins, a new guided step sets them up: the invitation, the right settings, and a one-page guide for them. Every new site also comes with one shared rulebook that all AI assistants follow, so nobody overwrites anybody.
• 🔐 Your website is yours — keep it that way. When you set up your accounts, your assistant now explains that they and your website belong to you, and recommends signing in with a second step, like your fingerprint, face or phone, so a stolen password alone can't get anyone in. It's a recommendation, not a requirement.
• 🔀 Your real address gets the credit. Once your site is live, anyone who lands on its temporary address is sent to your real domain, so AI answers point people to the right place. It stays off until you switch it on at launch; your assistant knows the steps.
• ⏩ Tidying up is quick again. Removing a finished piece of work no longer runs the whole build-and-test check first.
• 🔒 Fresh building blocks. Your site's building blocks are updated to their latest versions, including a security fix.
• 🧹 Behind the scenes. Sturdier built-in checks that now also run cleanly on a Mac, and a more thorough way for your assistant to get a second opinion on its own work.
• 🔁 Already have a site? Nothing changes on its own. If you got the toolkit straight from GitHub (rather than as the download below), ask your assistant: "check if my site needs any updates from the latest website-builder version" — it lists what changed and helps you apply it.

New here? How to start: download website-builder.zip below, unzip it, and paste the starter prompt from the README into your AI assistant — it takes you by the hand from there. Works on macOS, Linux, WSL, and Git Bash on Windows.

---

For the technically curious:

• New website-story skill: STORY.md template, a seven-section home page map, an opt-in tests/story.spec.ts that compares the CTA's resolved URL (scheme, origin, path, hash), evals; offered once from new-website §2a — PR #133, PR #137, PR #139.
• GEO check in search-console-insights: "Knows you" / "Finds you" per engine, counted in code, drift check, --report; track.sh runs every step and ends with a needs-attention list — PR #121, PR #122.
• AGENTS.md + CLAUDE.md in every scaffold and the website-team-setup skill; CI turns red on [MISSING: …] placeholders. The skill's evals ran for the first time (plan-only, 21/22 with vs 9/22 without) and two broken steps were fixed — PR #111, PR #120, PR #124, PR #139.
• Two-factor / passkey recommendation for GitHub and Cloudflare in README, GETTING-STARTED, SETUP.md, new-website and website-team-setup; never required unless the provider requires it — PR #139.
• functions/_middleware.ts 301-redirects the exact production <project>.pages.dev host once CANONICAL_URL is set; previews keep noindex — PR #118.
• The template's pre-push hook exits 0 for a delete-only push, tested under bash, sh and dash (tests now assert exit status) — PR #125, PR #139.
• Template dependencies refreshed in range (astro 7.3.5, devalue 5.9.4 for GHSA-9rgm-9g3h-6x36, svgo 4.1.0) — PR #112, PR #103.
• independent-review: review depth, parallel tiers, review_log.sh with gate ids, claims sweep, round budget, merge links, --seat, Codex run outside the repo, --hidethinking for ollama, full process-tree stop — PR #106, PR #110, PR #113–#117, PR #126, PR #128, PR #132, PR #136, PR #138, PR #139.
• Suite guards: CDPATH-safe script self-location, a fail-safe pipefail early-exit-pipe guard, pipefail status fixes in package.sh and friends, a packaged-zip leak test, a secret-pattern self-test; macOS bash 3.2 / BSD-tool compatibility, and make check inside an enclosing git repo — PR #119, PR #123, PR #127, PR #129–#131, PR #139.
• Every PR since 0.26 without a Codex review was reviewed by Codex + ollama-cloud before this release; trail in docs/reviews/REVIEW-diff-2026-09-27-pre-release-v027.md — PR #139.

0.26

website-builder 0.26 — the checks in your download work again, and a half-finished review owns up 🧰

As always: your favorite AI assistant takes you by the hand — just ask it, in your own words, and it does the work.

What's new:

• ✅ The checks inside your download work again. The zip was missing one of the files make check needs, so the checks stopped part-way through with an error. Fixed — and the check that scans your download for stray personal data now stops with a clear failure instead of quietly passing over a file that isn't there.
• 🔍 A review with a missing reviewer no longer passes for a complete one. If you use the review helper, one of its two independent reviewers dropping out — a rate limit, a signed-out tool — used to leave no trace: you saw one review and assumed that was all there was. Now every reviewer that was tried appears, a failed one is shown with its error (a recognised quota refusal says "wait or add credits"; anything else shows the error to read), and the run ends with one line naming who actually reviewed. One known gap remains: a reviewer that refuses in the shape of findings can still be counted.
• 📌 Installing from a git clone? Re-installing now keeps a skill you pinned to another worktree, and tells you it kept it; --force relinks everything as before. From a downloaded zip there is no git information to check, so pins are not kept there — the run says so and names every link it moved.
• 🗣️ The installer says what it moves. Every link it repoints away from another location is named on screen, and a mistyped or extra option stops the run instead of being silently ignored.
• 🧹 Housekeeping. The security policy now ships in your download, so you can see where to report a problem. Clearer install instructions in the README and the Codex guide, and two new automated test suites — 73 checks each — covering the installers and the review helper.
• 🔁 Already have a site? Nothing changes on its own. If you keep the toolkit as a git clone, ask your assistant: "check if my site needs any updates from the latest website-builder version" — it lists what changed and helps you apply it; a few template pieces still need a hand.

New here? How to start: download website-builder.zip below, unzip it, and paste the starter prompt from the README into your AI assistant — it takes you by the hand from there. Works on macOS, Linux, WSL, and Git Bash on Windows.

---

For the technically curious:

• Both installers (scripts/install.sh, scripts/install-codex.sh) keep a symlink resolving into a linked worktree of this repo at the same skill, and report it; --force relinks. Resolved links moved from elsewhere are announced; where the check cannot run — no git, a git without rev-parse --path-format, or a copy that is not a repo, including the released zip — one note says so alongside those relinks. Unknown and trailing flags exit 2 — PR #105.
• scripts/package.sh ships scripts/test_install_pin.sh, scripts/check_template_coverage.sh and SECURITY.md; the coverage script was missing, so a packaged make check stopped at exit 127 — PR #105, PR #107.
• check_clean.sh fails on a missing scan target instead of naming it in the OK line, and treats a grep exit > 1 as a scan error rather than "no hits" — PR #107.
• independent-review: every attempted tier leaves a stdout section — its review, or a FAILED one quoting the error with terminal control codes stripped — a closing reviewers: line names each outcome, recognised quota refusals are told apart from other failures, and a round with fewer than two counted reviewers says so. Exit codes unchanged. Also fixes a pre-existing case where an unrecognised escape truncated an ollama review that still counted; the refusal validator's known gaps are tracked, not fixed — PR #104.
• Two new CI jobs, review-reporting and install-pin, run those suites on ubuntu-latest; both suites were also run locally on macOS (bash 3.2) and in a Debian container. Windows is untested — PR #104, PR #105.

0.25

website-builder 0.25 — see how Google finds you, and a fresh-eyes check on your message 🔍

As always: your favorite AI assistant takes you by the hand — just ask it, in your own words, and it does the work.

What's new:

• 📈 Your search rankings now build a history on their own. Every time you ask "where do I rank for…", the answer is also saved. Ask again in a few weeks and you get a trend, not just a snapshot: is a keyword climbing, slipping, or holding? Your assistant will also offer, once per site, to check automatically every week so the history keeps building even when you forget to ask.
• 🎯 The right search phrase gets the credit. When people find you through many similar searches, your assistant now reports the position for the phrase you actually asked about, once it has enough data to trust, rather than a long rambling search that happened to be seen a few more times. It also shows the runners-up, so you can see what the number stands on.
• 🔒 Your Bing key stays out of your log files. If a Bing lookup failed, the error message could contain your private key and land in a log on your computer. That's fixed, and a set of tests now makes sure it stays fixed.
• 🧭 New: "Does my site make sense to a stranger?" Ask your assistant for a positioning check and you get a one-screen verdict on an existing site: is it clear who it's for, what they get, and why they should believe you? It names the one thing hurting you most and the three fixes with the biggest payoff. Read-only: it never changes anything unless you ask.
• ✅ A test run can no longer pass by accident. If you keep more than one site on the same computer, the checks for one site could quietly run against a leftover copy of another and still come back green. Each site now uses its own address for testing, and if something else is already sitting there, the run stops and says so instead of pretending. New sites get this automatically; for an existing site, ask your assistant to bring the test setup current.
• 🧹 Housekeeping. A security update to one of the site template's dependencies, clearer instructions in a few skills, and tidier project notes.
• 🔁 Already have a site? Nothing changes on its own. Ask your assistant: "check if my site needs any updates from the latest website-builder version" — it'll look at what's changed and bring your site current.

New here? How to start: download website-builder.zip below, unzip it, and paste the starter prompt from the README into your AI assistant — it takes you by the hand from there.

---

For the technically curious:

• Search Console: ranking history is appended by default on every keyword run (--no-csv opts out), with a site column so several sites can share one file; the weekly launchd job keeps its per-site settings across reinstalls; keyword matching is whole-word, handles German compounds and umlauts, and picks the exact phrase over variants once above the trend's noise floor — PR #93, PR #98.
• Bing API key redacted from all request errors, pinned by mutation-tested unit tests — PR #97, PR #100.
• New website-positioning-check skill, copied into every kit-built site; sibling skills point to it — PR #95, PR #96.
• Playwright test port derived from SITE.url (4330–4999), reuseExistingServer off, strictPort on the preview — PR #102.
• fast-uri security bump in the Astro template — PR #94. Docs — PR #99, PR #101.

0.24

website-builder 0.24 — smoother agent-driven testing, and complete handoffs 🔧

As always: your favorite AI assistant takes you by the hand — just ask it, in your own words, and it does the work.

What's new:

• 🧪 No more false test alarms. When your assistant runs your site's tests to check its work, a quirk in the underlying tools could make a perfectly working site look like it failed partway through. That false alarm is gone — your assistant can trust a clean test run again.
• 🔗 Complete, working handoffs. Your site's project folder is meant to be fully self-contained — everything anyone needs, right there. A bug could leave a few of its included skill folders as broken shortcuts pointing back at the computer that built them, instead of the real thing. Every handoff is now genuinely complete.
• 🔁 Already have a site? Nothing changes on its own. Ask your assistant: "check if my site needs any updates from the latest website-builder version" — it'll look at what's changed and bring your site current.

New here? How to start: download website-builder.zip below, unzip it, and paste the starter prompt from the README into your AI assistant — it takes you by the hand from there.

For the technically curious: the details are in PR #92.

0.23

website-builder 0.23 — safer launches, and numbers you can trust 🚀

As always: your favorite AI assistant takes you by the hand — just ask it, in your own words, and it does the work.

What's new:

• 🛡️ A safety net for launch day. New sites now come with built-in guidance that stops a brand-new page from getting stuck showing "page not found" to every visitor in the moments right after you publish it. That guidance used to live only in our internal toolkit — now it ships with your site, ready whenever you need it.
• 📊 Even more trustworthy Search Console numbers. Your traffic and ranking reports just got more careful: real page-and-keyword matching instead of guesswork, honest labels when a number is capped or estimated, and a smarter view that won't hide a real change in your rankings behind noisy day-to-day swings.
• 🧰 Housekeeping under the hood. New sites also start on fresher, more secure versions of the tools they're built with, and we tightened up the toolkit's own internal checks — nothing you'll notice day to day, but it keeps future updates smooth and safe.
• 🔁 Already have a site and use Search Console insights? Nothing changes on its own. Ask your assistant: "refresh my site's Search Console skill to the latest website-builder version" — it'll bring the more accurate reporting to your existing site.

New here? How to start: download website-builder.zip below, unzip it, and paste the starter prompt from the README into your AI assistant — it takes you by the hand from there.

For the technically curious: the details are in PR #80, #81, #82, #83, #84, #85, #86, #87, #88, #89, #90, and #91.