0.32

Croftweaver 0.32 — new helpers, and no visitor counting unless you choose it 🌱

As always: your favorite AI assistant takes you by the hand. Just ask it, in your own words, and it does the work.

What's new:

• 🌱 New sites count no visitors until you say so. On a new site, your visitors' browsers contact no analytics service at all. Want numbers? Ask your assistant to switch on Plausible. Nothing warns you if it stays off, so check once that numbers arrive.
• 🛰️ Count visitors without a script, if you prefer. Plausible can now count through Cloudflare instead, with no analytics script in your visitors' browsers. You lose a few extras, such as how far people scroll and the contact form's count. This way is new, and not yet tested with Plausible's paid cloud service. Your assistant explains both ways and walks you through the one you pick.
• 📨 See which pages bring you enquiries. With Plausible on, your site counts each click on your email address. With the usual script, it also counts each time the contact form asks the browser to open the visitor's mail program. Our counter leaves out your email address and what anyone typed. Before launch, add a goal called Email Tap in Plausible; your assistant reminds you.
• 🧭 Easier Plausible setup. Your assistant now suggests Plausible's paid cloud service, unless you already run your own Plausible server. It gives you links to the Plausible pages you need, and helps if one doesn't open.
• 🔒 A clearer privacy page. It now says what Plausible reads and sends, and how a visitor can refuse it. With no analytics, and nothing else added that needs consent, your site needs no cookie banner. With Plausible, whether it needs one is a judgment call, and your assistant says so plainly. This is not legal advice.
• 🎨 Colours and a logo, if you have none yet. A new helper writes three short requests for the design tool you like. Bring back the result, and it checks that your text colours stand out from their backgrounds, in light and dark mode. Then it puts the colours and the logo into your site. If your site's tests fail, it puts your files back and tells you if it couldn't.
• ✍️ Find the short line under your logo. Say "help me with a tagline". Your assistant finds it with you and keeps it short.
• 🔌 Install it your way. Croftweaver now comes as a plugin for Claude Code and for Codex. Or type one line, npm create croftweaver, in any terminal. The README shows each way, and how to update.
• ☁️ Cloudflare, checked and set up for you. A new checklist names the Cloudflare settings your site relies on. A check reads your live site and tells you what to change. It changes nothing itself. For a site on GitHub, your assistant can now do the setup for you. It asks for your yes before it changes anything, on setup day and again on launch day.
• 📊 See how Google and Bing show you in AI answers. Download each report and tell your assistant "here's my AI report from Google" (or Bing). Your Google & Bing page then shows the numbers. For a small site they are often empty for now, and the page says so.
• 🛠️ One thing to fix each week. Your weekly search report now suggests one small change: words people search for that the top of your page doesn't mention. Say yes, and your assistant makes the change and shows it to you first. Say no, and it waits twelve weeks before it suggests that one again.
• 🗂️ All your reports in one folder. Ask your assistant to gather your reports, downloads and checks in one analytics folder in your site's folder. It stays on your computer: your site's settings keep it off GitHub.
• 🚚 Moving from WordPress? A new helper counts your old site's posts, pages and addresses before the move. Afterwards it checks that each old address it found still leads somewhere. It only reads; it moves nothing.
• 🏡 Already have a live site? The README now lists the helpers that work on it as it is, without a rebuild.
• 🙏 One small favour. Once your site is live, your assistant asks once whether you'd add a "Built with Croftweaver" link. A no is fine, and it never asks again.
• 🔐 Safer by default. In Claude Code, new sites now block the usual commands that overwrite work on GitHub. Google's key files stay off GitHub. You can check that your download arrived intact, and the one-line installer now does that check for you. A new page lists what the helpers run and contact.
• 🔎 Sharper launch checks, and fresh building blocks. The check for leftover slots such as "[Your name]" now catches more of them. New sites build on the newest version of the site engine.

🔁 Already have a site? Nothing changes on its own. Your visitor counting stays as it is: "off" is the new start for new sites only. To pick up the rest, ask your assistant. Say: "check if my site needs any updates from the latest Croftweaver version". It compares your site with the newest template and helps you apply what changed. Some changes need asking for by name:

• "add the enquiry count from the latest template to my site" (if you use Plausible).
• "add the new lines for my .gitignore from the latest template".
• "switch my site to Plausible's server mode", if you want to count without a script. It also needs two settings in Cloudflare; your assistant walks you through them.
• If you use Plausible's usual script and the update offers new security headers, say: "keep my own analytics line in the headers". Without it, your visitor counting stops.

New here? How to start: download croftweaver.zip below, unzip it, and paste the starter prompt from the README into your AI assistant. It takes you by the hand from there. Works on macOS, Linux, WSL, and Git Bash on Windows.

0.31, a few days ago, gave the toolkit its new name. Your site stays as it is, and old links still work. What 0.30 brought is on the 0.31 page.

---

For the technically curious, 0.32:

• Analytics: the starter ships USE_ANALYTICS = false and a public/_headers with no analytics host; switching on means true, the real scriptHost/scriptId, and the host in script-src and connect-src; tests/check_analytics_gate.sh checks the builds and the headers either way, and CI tests both states. A config.ts with no USE_ANALYTICS line counts as on, so existing sites are unchanged — PR #336, PR #338. The per-site Plausible script with its init stub, and privacy pages that say what it reads, sends and stores — PR #264. Server mode: ANALYTICS.mode: 'server' plus the Production variables PLAUSIBLE_HOST and PLAUSIBLE_DOMAIN; functions/_middleware.ts sends page views to the Events API, email links go through /go/email, robots.txt disallows /go/; set the variables only with the switch on and the mode server. Q5 suggests Plausible's cloud service unless the owner already runs a Plausible server, and says Cloudflare counts no custom events — PR #343; Q5 gives Plausible's installation, settings/goals and sites/new pages as links, and the starter README and config.ts link the ones they need (seen on self-hosted Plausible; on Plausible Cloud expected, not checked) — PR #345. For an existing site, whats-new lists functions/_middleware.ts, functions/go/email.ts, tests/analytics-server.spec.ts and the gate: take the four together — PR #339; the plan's status rows after the merge — PR #344.
• Enquiry count: one "Email Tap" event from EmailLink.astro and from mail-form.js just before it hands over to the mail program; only the event name is passed. Measured once in Chromium, Firefox and WebKit, and by hand in Safari; on self-hosted Plausible CE v3.2.1 taps sent before the goal existed were counted once it was created, unlike Plausible's docs, so add the goal before launch either way. whats-new reports tests/email.spec.ts but not the site's own EmailLink.astro: take both — PR #287, PR #294, PR #298; records — PR #296, PR #306, PR #307, PR #315.
• Privacy and consent: the open-visit clause (EN and DE), from Plausible v3.2.1's session cache — PR #278; Q5's no-banner point, the DNT/GPC paragraph and the refusal sentence with its host slot — PR #330; Cloudflare's own Traffic counts as a path for owners, named in section 2 — PR #333; tests/privacy-host.spec.ts — PR #332; one slot rule shared by it and the placeholders test in tests/_helpers.ts (PLACEHOLDER_ALLOWLIST; merge _helpers.ts with both specs) — PR #337.
• New website-brand-kit skill: palette check of 30 text/background pairs in both themes, SVG check, seven icon files, install with rollback on a failed build or test; it adds about 0.6 MB to a site, because its toolkit tests stay behind; evals 28 of 30 with the skill, 10 of 30 without; its toolkit tests stay out of sites, and a failed git read in whats-new no longer reads "Up to date" — PR #283, PR #305, PR #309, PR #316; follow-up rows and why the review took 31 hours — PR #301, PR #304.
• New website-tagline skill, writing TAGLINE.md and SITE.tagline, and its opt-in tagline.spec.ts (shown once, at most 8 words and 50 characters) — PR #270, PR #275, PR #279.
• Install routes: a Claude Code plugin (.claude-plugin/, installs from the branch stable, which the release-tag workflow moves to each release tag); skills name their files relative to their own folder — PR #276; a Codex plugin from the same branch — PR #300; npm create croftweaver (packages/create-croftweaver, 0.1.0, downloads the latest release's zip, --codex and --antigravity) — PR #268; create-croftweaver 0.2.0, published to npm once this release is live, checks the zip against the release's SHA256SUMS before it unpacks anything and installs nothing on a mismatch or a missing file, and npm's prepublishOnly hook runs check-release.mjs, which tries it on the latest release, before publishing — PR #346, PR #277, PR #280; skills.sh lists the suite under the new name — PR #314.
• Cloudflare: docs/CLOUDFLARE-CHECKLIST.md — PR #266, PR #285, PR #319; cloudflare-check.mjs, read-only GETs, Node 18+ — PR #267; the script monitor (Client-side security): named by the checker, step 5 with its counting loop and data setting, its own-domain address, "a risk, not a verdict" — PR #299, PR #313, PR #322, PR #324, PR #325, PR #327; an HSTS of one month is no longer called too short — PR #310; cloudflare-setup.mjs with its setup and launch stages, one short-lived token, an asked yes before any write, tests against a stub of the API, and the check script's --only and --nameserver — PR #328, PR #334; direct upload sets CLOUDFLARE_ACCOUNT_ID first (Wrangler 4.151.0 stopped without it on a token that could not list accounts) — PR #345; plans — PR #265, PR #303, PR #320, PR #329, PR #331, PR #335, PR #340; Pages or Workers — PR #263, PR #272.
• search-console-insights 1.8.0: scripts/ai_reports.py imports Google's "Search Generative AI performance" and Bing's "AI Performance" exports (neither has an API) — PR #295; the weekly fix proposal, scripts/fix_proposal.py: positions 8 to 20 with 50 or more impressions, the business name and pages that already carry the words left out, a 12-week rest after a no — PR #302, plans PR #286, PR #297, PR #290; the site's analytics/ folder and analytics_snapshot.py — PR #311.
• New wordpress-inspector skill: wp_inventory.py and check_move.py, read-only, Python 3.9+ standard library; an incomplete count exits 1 — PR #281, PR #291. facts-check reads sitemaps with the XML parser stopped at a document type — PR #293.
• new-website §4b asks once for a credit after launch — PR #271; README on the maintainer and what works on a live site — PR #284.
• Safety: the starter's .claude/settings.json blocks git push with --force, --force-with-lease, -f or a + branch (a bundled -uf still runs); .gitignore keeps /client_secret*.json and /token.json out (whats-new does not track .gitignore); gsc_query.py reads the Google client file from ~/.config/gsc-insights/; website-permissions wording — PR #308; SHA256SUMS beside the zip — PR #317; docs/WHAT-THE-SKILLS-RUN.md — PR #292.
• Starter tests: the placeholders test reads each page three ways — PR #289, PR #312. Astro 7.3.8 and two minor bumps — PR #323.
• Housekeeping: independent-review runs only GLM 5.3 on Melious (Flash at Light depth only), checks a round's kind and cut from round 4, and prints a running cost line — PR #269, PR #274, PR #288; test_mktemp_guard.sh under bash 5.3 — PR #341; two skill descriptions fixed (website-seo-geo, website-design-system) — PR #342; tracker rows — PR #273, PR #282, PR #318, PR #321, PR #326.