0.33

Croftweaver 0.33 — photos that take turns, tidy tables, and safer publishing 🖼️

As always: your favorite AI assistant takes you by the hand. Just ask it, in your own words, and it does the work.

First, one thing for everyone: Node.js, the program your site is built with, had security fixes on 21 October. Check yours: ask your assistant "is my Node up to date?", and update it if it's older. This matters even if you haven't built a site yet.

What's new:

• 🖼️ Photos at the top of a page that take turns. A new, optional helper shows a few photos one after another, with one dot per photo. You choose whether visitors get a Pause button (the default) and whether photos swap at once or fade. Ask for "photos that rotate at the top of my home page"; it never runs unasked.
• 📊 Tables that fit on a phone. Tables now have one shared style. Tables of sentences turn into neat stacked rows on a small screen; tables of numbers stay tables and fit a phone's width. No more tables that scroll sideways or words broken in odd places.
• 🧳 Moving off WordPress: the forwarding, done for you. After the count of your old site, a new step gives you a simple sheet: for each old address, write its new address, "keep" or "let go". The helper then writes the forwarding rules for your new site, and the check after the move tells you when an old address lands somewhere other than you decided.
• 🔄 Updates that come to you. New sites get one tidy suggestion a month from GitHub with the small updates for your site's building blocks, ready for you to accept. The setup guide asks you to name who looks after them. Your site's automatic checks can now read your project and nothing more.
• 🛡️ Built on the safe Node. New sites build on the newest Astro, which needs Node with October's security fixes. If your Node is too old, your assistant stops and tells you before anything is built.
• 🚀 Publishing that doesn't trip over unsaved work (for sites with a preview and a live version). If several people or assistants share one folder, an option lets publishing take the reviewed version straight from GitHub, so a half-finished file or another branch in the folder no longer blocks it. It's off unless you switch it on, and publishing now says plainly when it can't tell whether a stopped publish landed.
• 📈 Your weekly Google report keeps working. The setup now asks you to publish the small Google app it uses, because an unpublished one loses its connection after a week. Reconnecting after a refused sign-in now opens the browser instead of stopping, and several sites' weekly reports no longer start at the same moment or ask the AI engines all at once.
• 📝 Clearer Plausible setup. The guide now links the goals page directly, says the site name in Plausible must match exactly, and has a short checklist for when no visits arrive.
• 🧹 Behind the scenes. The README and the Codex and Antigravity guides now claim only what was tested. Your assistant's second opinion on its own work refuses a review against the wrong starting point, sends each reviewer only what fits, and no longer sends a review with hidden "thinking" notes to the small models that misread them.

🔁 Already have a site? Nothing changes on its own. Ask for what you want: "add the rotating photos to my home page" or "use the new table style on my site". To get the monthly update suggestions and the read-only checks, ask: "take the Dependabot file and the new ci.yml from the latest Croftweaver starter". If your site publishes in two stages, ask: "update my publish script to the latest Croftweaver version". If you got the toolkit straight from GitHub (rather than as the download below), ask: "check if my site needs any updates from the latest Croftweaver version".

New here? How to start: download croftweaver.zip below, unzip it, and paste the starter prompt from the README into your AI assistant. It takes you by the hand from there. Works on macOS, Linux, WSL, and Git Bash on Windows. To check the download, put SHA256SUMS beside it and follow the README's two-line check.

---

For the technically curious, 0.33:

• Node: security releases of 2026-10-21 (v22.23.4, v24.22.1, v26.12.1). New sites build on Astro 7.4.2, which needs Node 22.23.4 or newer; the starter's engines names the fixed version of each line (22.23.4, 24.22.1, 26.12.1), so npm warns on anything older, on Node 23 and 25, and on lines older than 22; new-website stops on that warning, and scripts/check_node_floor.sh keeps the files in step. The installer's own floor stays 22.12. An existing site keeps its own package.json and Astro version; whats-new lists SETUP.md and a ci.yml comment. An owner who bumps Astro past 7.3.8 takes the new floor by hand (7.4.0 needs 22.22.0, 7.4.2 needs 22.23.4) — PR #377, PR #380; vite 8.3.4 — PR #370.
• website-hero-carousel, a new opt-in skill: a component, one script of the site's own, texts in English and German, and tests/hero-carousel.spec.ts. Pause: a visible Pause / Resume button (default) or pause="dots", where choosing a dot stops it until reload (SKILL.md "Pause" covers what that means for accessibility); instant swap (default) or fade — PR #392.
• Tables: website-design-system gains a Tables section (stack and figures), the starter gets src/styles/tables.css (imported by Base.astro after global.css) and tests/tables.spec.ts — PR #391.
• wordpress-inspector: make_redirects.py --draft turns urls.csv into moves.csv; the owner writes a new path, keep or let go; the script writes public/_redirects lines (301, both slash forms, both escape cases, chains followed) and refuses what _redirects cannot do. check_move.py --moves moves.csv reports an address that ends somewhere other than decided ("not as decided"); an unreadable address in the list stops the run with exit 2 — PR #358.
• Starter: .github/dependabot.yml (monthly, grouped minor and patch updates for npm and for GitHub Actions; new majors of typescript and @types/node held back; security updates stay on without the file) and permissions: contents: read in ci.yml. Existing sites: make whats-new PROJECT=<site> lists .github/dependabot.yml as missing and ci.yml as changed; read the file's header first, since GitHub's options reference says ignore also affects security-update pull requests — PR #379.
• Two-stage sites: scripts/ship.sh and tests/check_ship_push.sh are template-version 0.22; take them together. With git config ship.fromGitHub true, npm run ship publishes GitHub's main from a temporary worktree (an edited scripts/ship.sh still stops it). In both modes the push names refs/heads/production, a refusal is named "production moved", a publish stopped part-way that git cannot settle says it "may or may not have landed", and a Playwright "is already used" names the taken test port. Also take scripts/hooks/pre-push and scripts/wire-hooks.mjs — PR #376, plan rows PR #386, PR #389.
• search-console-insights: publish the Google app (In production), including for owners who already have a sign-in — PR #363, PR #373; an interactive reconnect after a refused refresh opens the browser — PR #352; each site's weekly job gets its own start minute — PR #354; one site's AI check at a time (a shared lock) — PR #357, PR #359.
• Plausible: server mode's step 6 done for self-hosted — PR #364; setup docs (goals page, site name = PLAUSIBLE_DOMAIN, pages.dev, "if nothing arrives") — PR #366; template test: server mode refuses an email subject over 200 characters at build time — PR #347.
• Docs: README first paragraph and the Codex and Antigravity claims — PR #355, PR #356; docs/WHAT-THE-SKILLS-RUN.md updates — PR #365, PR #388; the Codex plugin's opt-in test make test-codex-plugin — PR #348; a maintainer tool that runs the Antigravity checklist through agy (not in the zip) — PR #396.
• independent-review: comments and docstrings are claims to check — PR #362; a sandbox aside is not taken for a refusal — PR #367; --base refuses a diff on the wrong base — PR #372; a text record relabelled as binary is refused — PR #374; per-seat size limits and prompts on stdin — PR #378; a late round's open RISK is fixed, not put to the owner — PR #381; deepseek-v4.1-flash-1017 allowed on Melious for a Light review — PR #393; a model marked light is not sent a review whose text holds a think tag (melious FAILED (think-tag guard: ...), nothing sent); GLM 5.3 is not affected — PR #394, PR #397, plan PR #383, PR #384.
• Guards: every file under the new-website templates sits in one bucket — PR #353.
• Plans for later: domain-move status rows — PR #350; the legal notice on generated sites — PR #390; a --wording-pass option for the review script — PR #398. Decision records and tracker rows — PR #349, PR #351, PR #368, PR #369, PR #375, PR #382, PR #385, PR #387, PR #395.