0.29

website-builder 0.29 — one prepaid key for the weekly AI check 🔑

As always: your favorite AI assistant takes you by the hand — just ask it, in your own words, and it does the work.

0.27, 0.28 and 0.29 came out within three days, so this page covers all three: what's new in 0.29 first, then what 0.28 and 0.27 brought.

New in 0.29:

• 🔑 One key instead of four for "Does AI name you?" The weekly check can now ask ChatGPT, Claude, Gemini and Perplexity through a single OpenRouter account. You prepay once, 5 or 10 dollars or euros, and that covers the checks for weeks: a full weekly check for one site cost about $0.72 when we measured it. Each assistant still uses its own web search, so the answers are the same ones your customers get. Already have your own keys for each company? They keep working.
• 📍 Honest about one limit. Through OpenRouter, the check can't tell the assistants which country to search from. For a local business this barely matters, because its questions name the place ("bakery in Munich"). If yours don't, your assistant explains the options.
• 💶 You see what each check costs. Every weekly run shows its own total, and one assistant having a problem no longer stops the other three.
• 📈 A sturdier Google report. After 0.28, a second AI model reviewed the new "How people find you on Google" page. It now never swaps fresh numbers for older saved ones, says where saved numbers came from, and keeps working even if a settings file was edited by hand.
• 🧹 Behind the scenes. Your assistant's second opinion on its own work runs more reliably with one of the reviewing tools.

In 0.28:

• 📈 "How people find you on Google" — one page, in plain words. Ask your assistant "show me my Google report". At the top, one sentence answers "how am I doing?". Below it, week by week: how many visitors Google sent you (up to 16 months back), where you show up for the searches that matter to you, searches where you're just short of Google's first page, and pages people see but rarely click. Your Bing results are there too.
• 🤝 Numbers you can trust. The page only counts complete weeks, shows a percentage only when there are enough visitors for it to mean something, and says "not enough data yet" rather than guess. If Google can't be reached, it tells you and shows the last numbers it had, with their date.
• 🏠 It stays on your computer. The page is a single file on your own machine: nothing is uploaded. It works on a phone and in dark mode, every chart also comes as a table, and the weekly check keeps it up to date. It links to your "Does AI name you?" report, and back.
• 🧹 Behind the scenes. The built-in checks now also run on a Mac with its own standard tools, and from the unpacked download itself. The privacy check, which keeps personal names out of the toolkit, now also runs where the work is actually done.

In 0.27:

• 📖 Your home page can tell your customer's story. A new, optional step turns your home page into a short story: your customer, the problem they have, how you help, three simple steps, and what life looks like afterwards. Your assistant offers it once, right after you've worked out what makes you different, and never does it unasked.
• 🤖 "Does AI name you?" — a weekly check. Find out whether ChatGPT, Gemini, Claude, Perplexity or Google's AI answers mention your business when someone asks the kind of question your customers ask. It shows what each one knows about you from memory and what it finds when it searches the web, keeps every answer, and shows how things change week by week. Every assistant is optional and uses your own accounts; your assistant helps you set up one at a time, starting with a free one.
• 📊 A report you can actually read. Just ask "Show me my AI report for example.com". One plain answer at the top, a simple ✓ / ◐ / ✗ table per question, and the full answers tucked away for when you want them.
• 👥 Ready for a team. When a colleague or partner joins, a new guided step sets them up: the invitation, the right settings, and a one-page guide for them. Every new site also comes with one shared rulebook that all AI assistants follow, so nobody overwrites anybody.
• 🔐 Your website is yours — keep it that way. When you set up your accounts, your assistant now explains that they and your website belong to you, and recommends signing in with a second step, like your fingerprint, face or phone, so a stolen password alone can't get anyone in. It's a recommendation, not a requirement.
• 🔀 Your real address gets the credit. Once your site is live, anyone who lands on its temporary address is sent to your real domain, so AI answers point people to the right place. It stays off until you switch it on at launch; your assistant knows the steps.
• ⏩ Tidying up is quick again. Removing a finished piece of work no longer runs the whole build-and-test check first.
• 🔒 Fresh building blocks. Your site's building blocks are updated to their latest versions, including a security fix.
• 🧹 Behind the scenes. Sturdier built-in checks that now also run cleanly on a Mac, and a more thorough way for your assistant to get a second opinion on its own work.

🔁 Already have a site? Nothing changes on its own. If you run the weekly check, your Google page from 0.28 appears after its next run. Your weekly AI check keeps using the keys you set up. To switch, ask your assistant: "set up OpenRouter for my AI check". Once its key is added, it's used for all four assistants. If you got the toolkit straight from GitHub (rather than as the download below), ask: "check if my site needs any updates from the latest website-builder version". It lists what changed and helps you apply it.

New here? How to start: download website-builder.zip below, unzip it, and paste the starter prompt from the README into your AI assistant. It takes you by the hand from there. Works on macOS, Linux, WSL, and Git Bash on Windows.

---

For the technically curious — 0.29:

• geo_check.py: OpenRouter is the default route when GEO_OPENROUTER_API_KEY is set (direct keys are the fallback). It uses native provider search (plugins: [{"id": "web", "engine": "native"}]), and Sonar gets no plugin because it always searches. max_tokens is 4000. Run cost comes from usage.cost, including billed cut-off and empty replies. 401/402 stop the whole route; other errors stop only the one model. 408 and 429 are retried. A route switch is marked in the trend, and rows from before the route column count as "direct". Real OpenRouter replies are included as fixtures. Review: 2 rounds, 25 findings; the country limit is accepted as documented — PR #135.
• search_report.py: google-data.json is saved only after a successful fetch, and a failed save keeps the fresh page. Saved data records its key-search source (from). pick_property normalizes the domain, and hand-edited site records are type-checked. 6 new tests. These fixes come from an ollama-cloud read of #141 (20 findings, 6 held up); the fix itself had 1 review round with 14 findings — PR #144.
• independent-review: Antigravity gets its own prompt (PROMPT_AGY), no longer the text-only "You have NO tools" one, which made headless runs end on a refused tool call — PR #143.

For the technically curious — 0.28:

• New search-console-insights/scripts/search_report.py <domain>: writes ~/.config/gsc-insights/reports/<site>/google.html and google-data.json (the last successful fetch). Monday–Sunday weeks in Pacific Time ending before the API's firstIncompleteDate, impression-weighted weekly positions, one ["date","query"] request per key search, moves only with ≥2 usable weeks per side, a headline percentage only with ≥20 visits on both sides. track.sh records the settings it resolved in sites/<site>.json (never the Bing key) and builds the page after the AI check; geo_check.py's page links to it. 48 new tests. Plan: 7 Codex rounds + a final full read; code: 9 Codex rounds; two live runs on a real site — PR #141.
• CI job macos-stock-tools: make smoke under /bin/bash 3.2 and BSD awk/sed/tr/grep with a UTF-8 locale, asserted before it runs — PR #140.
• check_clean.sh reads the main checkout's gitignored name list from a linked worktree (it silently skipped it there) and accepts karero/website-builder#N; check_cdpath_safe.sh skips whats-new.sh loudly outside a git clone, so make check passes in the unzipped zip (it failed in v0.27's); new scripts/test_clean_denylist.sh and a macOS CI step running make check inside the unzipped zip — PR #142.

For the technically curious — 0.27:

• New website-story skill: STORY.md template, a seven-section home page map, an opt-in tests/story.spec.ts that compares the CTA's resolved URL (scheme, origin, path, hash), evals; offered once from new-website §2a — PR #133, PR #137, PR #139.
• GEO check in search-console-insights: "Knows you" / "Finds you" per engine, counted in code, drift check, --report; track.sh runs every step and ends with a needs-attention list — PR #121, PR #122.
• AGENTS.md + CLAUDE.md in every scaffold and the website-team-setup skill; CI turns red on [MISSING: …] placeholders. The skill's evals ran for the first time (plan-only, 21/22 with vs 9/22 without) and two broken steps were fixed — PR #111, PR #120, PR #124, PR #139.
• Two-factor / passkey recommendation for GitHub and Cloudflare in README, GETTING-STARTED, SETUP.md, new-website and website-team-setup; never required unless the provider requires it — PR #139.
• functions/_middleware.ts 301-redirects the exact production <project>.pages.dev host once CANONICAL_URL is set; previews keep noindex — PR #118.
• The template's pre-push hook exits 0 for a delete-only push, tested under bash, sh and dash (tests now assert exit status) — PR #125, PR #139.
• Template dependencies refreshed in range (astro 7.3.5, devalue 5.9.4 for GHSA-9rgm-9g3h-6x36, svgo 4.1.0) — PR #112, PR #103.
• independent-review: review depth, parallel tiers, review_log.sh with gate ids, claims sweep, round budget, merge links, --seat, Codex run outside the repo, --hidethinking for ollama, full process-tree stop — PR #106, PR #110, PR #113–#117, PR #126, PR #128, PR #132, PR #136, PR #138, PR #139.
• Suite guards: CDPATH-safe script self-location, a fail-safe pipefail early-exit-pipe guard, pipefail status fixes in package.sh and friends, a packaged-zip leak test, a secret-pattern self-test; macOS bash 3.2 / BSD-tool compatibility, and make check inside an enclosing git repo — PR #119, PR #123, PR #127, PR #129–#131, PR #139.
• Every PR since 0.26 without a Codex review was reviewed by Codex + ollama-cloud before 0.27; trail in docs/reviews/REVIEW-diff-2026-09-27-pre-release-v027.md — PR #139.