0.31

Croftweaver 0.31 — website-builder has a new name 🧶

As always: your favorite AI assistant takes you by the hand — just ask it, in your own words, and it does the work.

0.30 and 0.31 came out a day apart, so this page covers both: the new name first, then everything 0.30 brought.

New in 0.31:

• 🧶 website-builder is now Croftweaver. It is the same toolkit under the same free licence. Only the name is new.
• 🏠 Your site stays as it is. Nothing in a site you already built points at the old name, so there is nothing to change.
• 🔗 Old links still work. The old address on GitHub leads here. The download is now called croftweaver.zip. For this one release there is also a copy under the old name, website-builder.zip, so an old download link still gets you the newest version.
• 🧰 Got the toolkit straight from GitHub? It keeps updating as before. To tidy up, ask your assistant: "point my Croftweaver copy at its new GitHub address".
• 🔎 If you ask what changed: the update check lists three skills as changed (copywriting, search-console-insights, website-review). The only change in them is the new name.

What 0.30 brought:

• 📬 A contact form with nothing to set up. Visitors write their message, press a button, and their own email program opens with it, ready to send to you. No account, no password, no change to your domain's mail, and no bot can send through it. Every message arrives with the subject line you chose, and the visitor keeps a copy in their Sent folder. Good to know: a visitor who only reads mail in the browser may see nothing open, so your email address always shows under the form, and your site never learns whether they pressed Send. It speaks English and German, and your assistant offers it while planning your site.
• 🔎 Nothing half-finished goes live by accident. Before launch, your site's checks now read your finished pages and catch what's easy to miss: an empty slot like "[Your name]", leftover filler text, a forgotten "TODO". A new site still starts green; the legal pages remind you until they're filled in.
• 🧾 Your site stops contradicting itself. Keep one short list of the figures you stand behind: how many customers, how many countries, your satisfaction score. Ask your assistant "check our figures", and it reads every page of your live site and shows you where a number, an old name or a retired slogan no longer matches your list. It works on any website, not only one built with this toolkit.
• ⚡ Checking a change is much faster. Your site used to be built four times on every upload; now it's built once and tested once, with a short, readable result.
• 🤝 Say "merge", and your assistant does it. Until now you pressed the last button on GitHub yourself. If you work with Claude Code or Codex on your own computer, you can now just say "merge". Your assistant checks first that the tests are green, and it never merges unasked. Claude Code still asks you to confirm, unless you have allowed that command yourself.
• 🗣️ Your assistant answers in your language. Write in German, Spanish or anything else, and the reply comes in that language.
• 🔔 News comes to you. If you use Claude Code, it looks at your site's copy on GitHub at the start of a session and tells you what is new there, such as a change someone else made.
• 🏅 Show what your site gets right, if you like. A new, optional scorecard section shows visitors what your site's quality checks found, with your speed scores if you add them. Your assistant offers it; it never adds it unasked.
• 🤖 More choice for "Does AI name you?" Already have your own Gemini or Perplexity key? The weekly check can use it, including Gemini's free tier, where Google offers one. The cost shown for each run now also counts replies that were cut off or came back empty, and it says when a price is missing.
• 📚 AI-search advice that names its sources. Each figure in the advice on being named by AI assistants now links the study it comes from, or is gone. The advice on which AI robots to let in follows what OpenAI, Google, Anthropic and Perplexity say about their own robots, and your site's check now accepts a robots.txt that keeps training robots out.
• 📁 A clear home for your sites. The guide now says where to keep them: one websites folder, outside anything that syncs to iCloud or OneDrive. Your assistant asks before it starts, and tells you where your new site lives.
• 🪟 Smoother setup on Windows and inside bigger projects. A site set up inside a bigger project no longer switches off that project's own checks.
• 🔒 Fresh building blocks. New sites build on the current long-term Node version and come with three security fixes in the site's building blocks. The Google report now works with a Mac's built-in Python.
• 🛡️ Your site warns you about security holes. New sites now switch on GitHub's security alerts at setup. When a building block has a known hole, GitHub sends the fix as a ready-made change for you to accept.
• 🚀 Publishing without surprises. Cloudflare's free plan counts every visit against a daily allowance. One setting, now part of the first-publish steps, keeps your site online if that ever runs out. A site you first publish from your own computer now keeps its visitor statistics, and a site that isn't connected to GitHub gets its own publish command.
• 🇩🇪 A small fix for German legal pages. On an English site, the German legal notice now writes "[punkt]" in its email hint, not "[dot]".
• 🧹 Behind the scenes. Your assistant's second opinion on its own work keeps going when one reviewing service runs out of quota, works on older computers, says plainly why a reviewer failed, and stops sooner when there's nothing left to find.

🔁 Already have a site? Nothing changes on its own. The contact form and the scorecard are new pieces, so ask your assistant to add the one you want: "add the contact form to my site". Two settings are worth checking yourself: GitHub's security alerts (ask: "turn on the Dependabot alerts for my site, as the latest SETUP.md describes"; it may send you a fix or two right away) and Cloudflare's Fail open (ask: "walk me through Fail open for my site"). If you got the toolkit straight from GitHub (rather than as the download below), ask: "check if my site needs any updates from the latest Croftweaver version". It lists what changed and helps you apply it. It now also names pieces your site never got, such as the quick check before each upload, and your assistant puts them in place. One more for every existing site: two guides changed in ways that check can't show you, so ask once: "compare my PUBLISHING.md and SETUP.md with the latest template". And if you'd like to say "merge" on a site you already have, its AGENTS.md still says the assistant never merges, so ask: "bring the merging rule in my AGENTS.md up to date with the latest template".

New here? How to start: download croftweaver.zip below, unzip it, and paste the starter prompt from the README into your AI assistant. It takes you by the hand from there. Works on macOS, Linux, WSL, and Git Bash on Windows.

---

For the technically curious, 0.31:

• The rename: the name in prose, the repository address (karero/croftweaver; GitHub forwards the old one, and git remote set-url origin https://github.com/karero/croftweaver.git points an existing clone at the new one) and the handoff zip (dist/croftweaver.zip). The private-name check treats links to this repository as self-links under both names. Skill names, the review history and the installers' backup suffix keep the old name. Review: 3 rounds, 20 findings, no bug — PR #212.
• Docs only, since 0.30: the maintainer note on Pages or Workers records the decision to stay on Pages for now, with a comparison table — PR #261, PR #262; tracker rows closed after 0.30 — PR #260.

For the technically curious, 0.30:

• New website-contact-form skill: a mailto: form built by a same-origin script (a strict script-src 'self' holds), the address encoded as EmailLink encodes it, a required per-site subject, English and German, and a spec that checks the link the button opens; the form speaks its page's language by itself (Base.astro hands it down). The starter's EmailLink now escapes % in addresses — PR #215, PR #216.
• Rendered-placeholder test: slots, filler and TODO markers on built pages; an exemption list that only warns at launch (hard stop deferred to the publish gate) — PR #145.
• npm run verify: one build, one test run, short output, run by the pre-push hook; reinstalls only on a changed package.json or lockfile. The hook is wired by a Node script (wire-hooks.mjs), only where the site is its repo's root — PR #165, PR #149, PR #151.
• AGENTS.md stays English, assistants reply in the person's language; scaffolds get a Claude Code SessionStart sync hook with timestamped reports, tolerant of a read-only .git, tracked by whats-new. Its first cross-model review (Codex, Kimi, a fresh-eyes Claude pass; 3 rounds, 27 findings) fixed a failed listing that used up unreported commits, failures read as "nothing new", an override of the owner's own core.sshCommand, ssh errors hiding their cause, and nagging before a site is on GitHub; the test now runs the exact settings.json command — PR #166, PR #175, PR #196.
• New website-scorecard skill (Lighthouse scores typed in, a stale card labelled) — PR #148.
• New facts-check skill: facts_check.py (standard library only, Python 3.9+) reads the sitemap's pages and /llms.txt, ties each number to a fact by a term after it or a phrase before it, and reports OK, OUTDATED or MISMATCH, plus retired phrases still in use; positioning rules map page paths to the term each page owns; robots.txt is respected, and a run that read no page is never reported as clean. 108 tests against a stub site, run by CI on Python 3.9 and 3.12. Its first run over the network on a large live site (240 pages) showed false ties, so the nearest fact's term now wins, whole_words is an option per fact, and more date forms are read as dates. Its commands call the script where make install links it. Review of the skill: 16 rounds — PR #230, PR #239, PR #256, PR #257, PR #258; why it took 16 — PR #240.
• Template AGENTS.md §2: the assistant merges when the person says "merge", and only then. It re-checks the pull request first (checks, draft state, the §5 merge rule) and merges with gh pr merge --merge --match-head-commit, never --admin or --auto. The template's settings.json still does not pre-allow gh pr merge, so Claude Code asks at each merge unless the person allowed it elsewhere, and with Codex in the browser the person still presses the button. website-team-setup and TEAM-GUIDE.md say the same; §7 replaces the old bullet in an existing site — PR #255.
• Guide: one websites folder (Documents/Websites by default, elsewhere if Documents syncs to iCloud or OneDrive); <site> is defined in new-website as a new folder inside it; the toolkit keeps a folder of its own, because the installers link to it; the README's unzip line matches the zip (unzip website-builder.zip -d website-builder); a hidden note beside each of the two starter-prompt copies names the other — PR #243, PR #248, PR #253.
• geo_check.py: GEO_DIRECT_ENGINES routes named engines through their own keys; run cost includes replies that may have been billed — PR #152, PR #146.
• Starter on Node 24 LTS, GitHub Actions v7, TypeScript 7 held until @astrojs/check supports it, source-map-js 1.2.2, http-cache-semantics 4.3.0, sharp 0.35.5; Python 3.9 support restored for the Search Console scripts; Dependabot for this repo — PR #155, PR #162, PR #163, PR #164, PR #173, PR #206. These reach only new sites: an existing site has its own lockfile, so SETUP.md now switches on Dependabot alerts and security updates at launch, with the same lines for a site that already exists — PR #192.
• Publishing: the local first build sets CF_PAGES_BRANCH, or the live site ships without analytics; PUBLISHING.md gets a "Deploy by command" section for sites without a GitHub connection; the docs name the free plan's 100,000 Functions requests a day (the root _middleware.ts runs on every request), recommend Fail open, and correct the Cloudflare bandwidth and GitHub Actions budget claims; a test proves analytics is on only in the production build — PR #171, PR #207, PR #208, PR #210, PR #211, PR #213; a maintainer note, docs/PAGES-OR-WORKERS.md, on what moving the kit from Pages to Workers would change (it recommends staying on Pages for now; no decision taken) — PR #259.
• The German Impressum's email hint is German on an English site too — PR #183.
• independent-review: Melious as fallback for the ollama seat, key never written to disk, Perl pieces in perl/*.pl held to their declared version, skipped and failed reviewers name their cause, fewer empty rounds — PR #150, PR #167, PR #170, PR #172, PR #176, PR #177, PR #179, PR #185, PR #209; the paste-in prompt carries the text-only rule — PR #197.
• Starter: the email links' subjects ask for a request, "Anfrage" on the Impressum and "Questions" on the home page — PR #218; the German tone rule catches the superlative of "entfesselt" — PR #188; the site's own CI skips its test job for docs-only changes, and the setup skills name GitHub's 2,000 free Actions minutes and the budget fix — PR #217.
• whats-new: tracks PUBLISHING.md and SETUP.md (changes from before a site's baseline were never reported, hence the one-time comparison above), says when a bundled skill was removed from the suite, and marks a changed template file the site has no copy of as MISSING, shown only while it is newer than the site's baseline. Copying scripts/verify.mjs in also needs the verify entry in package.json and a pre-push hook that calls it — PR #153, PR #222, PR #221.
• independent-review: SECOND_SEAT=melious puts Melious in the second seat, with ollama as its fallback; the parallel test proves overlap by order, not by clock; past round 8 the summary says each further round is the owner's call, and refuted findings go into the --verify file; reviewers are asked for list-marked finding lines, so a real review is no longer discarded; merge_link.sh --suggest-callees lists the base-side files a change names — PR #202, PR #154, PR #236, PR #205, PR #193.
• Weekly AI check: for Perplexity the trend reads "in its results", not "cited", since its API doesn't say which results an answer quotes; the OpenRouter country note is current again; geo-check.md gets a quick path, a contents list, the HTTP 402 advice as one table, and lessons from a real run — PR #225, PR #227, PR #232.
• ai-seo: each ranking figure links its primary study or is gone, and ai-seo, schema-markup and website-seo-geo say Google has shown FAQ rich results only for well-known government and health sites since August 2023; the Princeton GEO table gives the paper's own Table 1 figures; the content-type shares and the Wikipedia and Reddit figures name their studies or are gone, and the two worked examples are plainly made up; the robots.txt advice splits the AI bots by job, as their companies' own pages do, and the starter's seo.spec.ts now reads robots.txt by group and fails only when everyone or a search crawler is shut out; the Presence section and the platform claims carry a source or are written as advice; search-console-setup gives what Cloudflare's own page says its AI-bot setting covers — PR #231, PR #235, PR #237, PR #238, PR #241, PR #244, PR #249, PR #250, PR #251, PR #258.
• Housekeeping: twelve of the toolkit's own check scripts now stop with an error when mktemp cannot make their throwaway folder, and a new test (scripts/test_mktemp_guard.sh, run by make check and CI) keeps it that way. Two of them, new since 0.29 (test_whats_new.sh, test_verify.sh), would have deleted the folder they were started from; neither was in an earlier release. Review: 4 rounds, 18 findings — PR #228.
• Housekeeping: CI cancels superseded runs; the private-name check covers scripts/, and CI now runs it with the list from a repo secret, printing hits masked — PR #169, PR #184, PR #189; the zip no longer carries the maintainer's two tracker files, and its leak check fails if one slips in — PR #258; the repo's text checks out LF where Git converts to CRLF — PR #168; the pipefail guard reads wrappers, paths, piped compounds and loops — PR #194, PR #198; template-tests runs on every change, so one check can be required — PR #203; doc fixes (missing file mentions, a stale comment, reviewer credits by seat) — PR #182, PR #191; a BUGLOG row for whats-new still pointing a site at a skill the suite removed, and other tracker rows and review records opened, closed or corrected — PR #180, PR #181, PR #187, PR #190, PR #199, PR #201, PR #219, PR #220, PR #223, PR #224, PR #226, PR #229, PR #233, PR #234, PR #242, PR #246, PR #252, PR #254; the plan for an optional colours-and-logo skill, for a later release — PR #245, PR #247.