site-triage

Changed

• web-launcher is renamed to site-triage. BREAKING for anyone with the old name in enabledPlugins: install is now /plugin install site-triage@voyvodka, and the skill is /site-triage. The catalog's renames entry maps the old name to the new one, so Claude Code 2.1.193+ rewrites user, project and local settings automatically; expect one plugin-cache-miss and a single /plugin install. The repository moved to voyvodka/site-triage; GitHub redirects the old URL.

  Diagnosis became the primary job, and "launcher" only described the first day. Triage — working out what is wrong and in what order to fix it — is what the skill's 🔴/🟡/🟢/⚪ rubric does, and "site" covers SEO, GEO, deploy and supply chain together. No content changed.

Added

• AI-search visibility is measurable now, and the references say where. Bing Webmaster Tools' AI Performance (citations, cited pages, grounding queries) and Search Console's Generative AI performance report (AI Overviews and AI Mode impressions, rolled out to every site on 2026-08-31) reverse the "no citation report" line in 04 and 15. The Search Console report is interface-only — no API search type, no bulk-export table — and 16 says so, with a first check for zero AI impressions: the property's Search generative AI setting.
• Release-age gates for npm, pnpm, Bun and Yarn, each in its own unit and with its real default, plus npm 12 blocking dependency install scripts unless allowScripts allows them (13).
• Cloudflare's AI bot policies (Search, Agent, Training) and Bot Preference Sync — the managed robots.txt block now carries use=reference, and a Free zone without its own robots.txt is served Cloudflare's Content Signals Policy text (06, 08, C2 in 14).
• Robots-honouring crawlers and user-triggered fetchers are told apart, quoting each vendor: ChatGPT-User, Perplexity-User, Meta-ExternalFetcher, Google-Agent and the other user-triggered fetchers may not follow robots.txt, so they are no longer listed as controls (03, 15). Meta-WebIndexer, Amzn-SearchBot and OAI-AdsBot are added.
• The live probes in 08, 09 and 11 print a verdict for every check: a status and location per redirect, 000/NO RESPONSE for a host that did not answer, MISSING: per absent security header — silence no longer reads as a pass.
• 08: Workers Builds, wrangler-action v4, Worker Previews and the cf CLI beta as paths (wrangler stays the documented one); cache Invalidate next to Purge; the redirect status codes each mechanism offers; an http:// probe in the verification block.

Changed

• Content re-verified on 2026-10-14; review due 2026-12-13. Every file was walked against its primary source; claims that could not be re-read keep their older stamp or a ⚠️.
• Search Console's reason table (16) uses Google's current labels and gains the reasons it lacked: Redirect error, Server error (5xx), 401, 403, other 4xx, Duplicate without user-selected canonical, Discovered – currently not indexed, and the two warnings, "Indexed, though blocked by robots.txt" and "Page indexed without content".
• Google's published timings are quoted instead of "Google publishes no timing": crawling after a request takes "a few days to a few weeks", a duplicate cluster "up to two weeks".
• satori moved from 0.33.5 to 0.56.1 with three breaking layout changes, none in the release notes: Taffy, browser display defaults, and CSS initial values for position, box-sizing and borders (a padded card overflows). 07 now splits the advice: @vercel/og 1.0.3 still runs 0.33.5, direct satori does not.
• isitagentready runs 22 checks in five categories and has an API; 06 names its own four signals as its scope and the rest as parked.
• GitHub Actions guidance pins every action by SHA, GitHub's own included, and covers the workflow lockfile (public preview). The pin check in 13 §13.11 skips only workflows the lockfile lists, reads quoted, CRLF and flow-style refs, and ends in an OK/FAIL line; 09 points at it instead of carrying a copy. Dependabot's default 3-day cooldown and its per-ecosystem limits are documented, and so is the gap: pnpm 12 and npm 12 sit outside the versions it documents (pnpm v7–v10, npm v7–v11).
• Versions re-resolved on 2026-10-14: wrangler 4.151.0, satori 0.56.1, svelte-sitemap 4.1.2, setup-node v7.1.0, codeql-action v4.38.3, pnpm/setup v3.1.1 (SHAs re-resolved), pnpm 12.11.2, TruffleHog v3.99.2, Syft v1.54.1. CI's own setup-node pin moved to v7.1.0.
• 08 and 13 re-read against the vendors: Cloudflare's Pages docs now steer new projects to Workers and C3 creates a Workers project by default (Pages is still not deprecated); --use-keyring keeps only the encryption key in the keychain; Automatic SSL/TLS is the default mode; Secret Protection cannot be bought for a personal private repository; Node 20 is gone from GitHub-hosted runners; npm trusted publishing expires unvalidated configurations after 48 hours and rejects issue_comment tokens.
• README leads with the one-step install, /plugin install web-launcher --marketplace voyvodka/claude-plugins (Claude Code 2.1.275 or later).

Fixed

• SVG logos are allowed. Organization.logo only has to be a Google Images format, and Google Images supports SVG. Search favicons are the opposite — Google's list has no SVG — so the ICO stays (01, 03, 10).
• The Search Console API has more writes than sitemaps.submit (sitemaps.delete, sites.add, sites.delete); they change the account, and the plugin never calls them (12, 16).
• Web Bot Auth: the directory's media type is application/http-message-signatures-directory+json and the response must be signed; the advice to publish an empty key set is withdrawn — the scanner requires a key and scores a missing directory as informational only (06, 09, 13, SKILL.md).
• The baseline Permissions-Policy shipped browsing-topics=(), itself deprecated — the same failure the note above it was written to fix (08).
• The Markdown-for-Agents middleware set X-Markdown-Tokens, which Cloudflare dropped on 2026-10-09, and lacked Vary: Accept, so a cache could serve markdown to browsers (06).
• llms.txt is linked with rel="describedby"; alternate is for a page's own markdown (03, 06, 08).
• A single trailing-slash redirect reports as "Page with redirect", not "Redirect error", and Googlebot follows up to ten hops rather than stopping at the first (09, 14, SKILL.md).
• The SoftwareApplication template is valid but not eligible for the rich result without aggregateRating or review; never invent one (03, 09).
• security.txt Expires is under a year, per RFC 9116; the sitemap template drops <changefreq> and <priority>, which Google ignores (03).
• 302/307 are a weak canonical signal, not none (14); sizes on <link rel=icon> is allowed, not required (01); theme-color is used only by installed web apps in desktop Chrome and Safari 26 (01, 02, 03).

Added

• CI's changelog check now requires a [x.y.z]: link for every released version and an [Unreleased] link that compares from the newest tag. Two releases shipped without their links and [Unreleased] kept comparing from v0.3.0; nothing looked, so nothing noticed.
• README: what to do when GeoDaddy fails to connect. The first npx start downloads the analyzer binary and can run past Claude Code's 30-second MCP limit (MCP_TIMEOUT raises it), and the package's postinstall ignores a failed download, so the server starts and only analyze_url breaks.

Changed

• Versions re-resolved on 2026-09-25 against npm and GitHub: satori 0.33.5, @vercel/og 1.0.3, astro-og-canvas 0.13.2, @astrojs/sitemap 3.7.4, wrangler 4.140.0, Lighthouse 13.5.0, codeql-action v4.38.2 (SHA re-resolved), TruffleHog v3.97.9, Syft v1.52.0, CycloneDX spec 1.7.2.
• pnpm 12 became latest, which is the event 13-dependency-security.md said to re-check on. pnpm/action-setup now supports pnpm 12 and earlier, but only from v6.1.0 — its floating v6 tag still points at v6.0.10 — so the example pins the v6.1.0 SHA with version: 12. pnpm/setup moved to a breaking v3 that installs pnpm 11+ only and runs pnpm install by default. The old "action-setup is for v10 and older" framing is gone.
• Lighthouse 13.5.0 reshaped the Agentic Browsing category: llms-txt changed group and an ard-schema audit (ai-catalog.json) was added. 11 lists all seven audits.
• draft-ietf-aipref-vocab-08 added an ai-use category. 06 said AIPREF had no counterpart to Content-Signal's ai-input; it now has a provisional one.

Removed

• Every indexing and logo timeline. 10 and 12 quoted unsourced ranges that disagreed with each other, while 09 said never to quote a number. 09's rule now holds everywhere: "days to weeks, depending on crawl frequency", and Search Console for the real signal.

Fixed

• C1 failed every healthy site. Its probe paths are meant not to exist, and since 0.3.0 only a final 200 passed, so a correct 404 printed FAIL. C1 judges redirects: a direct 404 now passes, a redirect ending anywhere but 200 fails, a 5xx fails, and the OK line counts how many probes actually redirected.
• C3 passed a site with no consolidation at all. Every variant answering 200 printed four OK lines — the split-authority and missing-HTTPS-redirect defects C3 exists to catch. Exactly one variant may now answer 200; the others must 301/308 into it.
• 09's action-pin grep matched nothing. It was the regex 13 had already replaced for exactly that reason; the sibling was left behind. It now runs 13.11 check 4.
• The baseline CSP still carried script-src 'unsafe-inline', although 0.3.0's changelog and 08's own note said it had been removed.
• SKILL.md's always-loaded pitfalls contradicted 08: an unconditional SPA fallback, two field observations 08 had removed as unsourced (purge before retesting, "Bindings=0"), and a Worker redirect where 08 recommends a zone rule. Rewritten to match 08.
• 08's Worker-redirect variant hardcoded the SPA fallback and its checks expected random paths to answer 200 — the soft 404 0.3.0 removed from the baseline. 11.1 tested www→apex only on a random path, the one probe that passes when a Worker never sees real pages.
• 09 and 11 pinned every probe to a hardcoded Cloudflare IP, which breaks a platform-agnostic audit of any site not on Cloudflare. The address now comes from DNS.
• 15's citation check could not see a Disallow. Grepping token names prints User-agent: lines and nothing for a User-agent: * block. It now resolves each token to its governing group. The file also said four of GeoDaddy's six bot checks were training crawlers; it is five.
• 16 mapped "Blocked by robots.txt" to indexingState: BLOCKED_BY_ROBOTS_TXT, which Google marks "Reserved, no longer in use" (as is verdict PARTIAL). It now uses robotsTxtState and pageFetchState.
• 13.11 ran yarn outdated, which 13.3 says Yarn Berry does not have, and the 13.3 workflow tag-pinned the third-party actions 13.7 says to SHA-pin.
• 06 called sitemap and security-txt IANA-registered link relations (they are not), told the reader to ship the empty JWKS placeholder while its own matrix says to skip it, and pointed at 11 for a live-vs-repo diff that lives in 14 C2.
• 09 proposed Content-Signal and the empty JWKS placeholder as fixes, called a missing Content-Signal a GEO weakness, and counted a scanner score rise as re-validation; 13.11 rated Content-Signal 🟡. 06's matrix and SKILL.md's ⚪ band say they have no known effect. They are intent-only everywhere now.
• mask-icon was dropped in 01 and 02 but re-added by 03's meta template, 09's patch plan and SKILL.md's scan. It is gone everywhere now; 03 and 02 gained the favicon.ico 01 requires.
• 02 stated as verified two iOS claims 01 says have no primary source.
• 05's orphan check compared /docs/x against /x, so every page read as an orphan.
• 11 cited Lighthouse font-size and tap-target audits that no longer exist, and miscounted the WebMCP audits.
• 03's humans.txt template carried a real project's stack; 13's examples a real timezone.
• 01's emoji search used grep -P, which macOS grep rejects.
• 14: C2's managed-block test printed nothing on success, C5 reported a sitemap index as clean, and C6/C9 missed tags whose attributes came in the other order.
• 03's llms.txt claim now cites Google's documentation update, and marks the crawler-traffic claim as secondary.
• SKILL.md said Mode A ran the Mode-B-only live probe and counted 13 validators where 11 lists
  15. Its description now leads with the trigger keywords.

Fixed

• Two release blocks in the changelog held the same fixes twice. 0.3.1 carried two ### Fixed headings describing the same four repairs in different words, and 0.3.0 split twenty genuine entries across two ### Fixed lists with a ### Changed between them. The cause was the same in both: separate pull requests each appended to [Unreleased], and the release stamped both without merging them. Merged, with every unique entry kept — including the **/references/local/ ignore-rule entry that appeared in only one of 0.3.1's two blocks and would have been lost by deduplicating on the heading alone. The Workers "deployment finished" claim, recorded once under Fixed and again under Changed, is now stated once.

Added

• CI checks the changelog's structure: no section heading twice inside one version block, only Keep a Changelog section names, an [Unreleased] section that the next change can land in, and one dated heading per version. This file spent two weeks stating the same fixes twice and no check looked; a written convention is not a check, which is the argument this plugin makes about every site it audits.

No reference file changed in this release — the diagnostic checks and their verification stamps are unchanged from 0.3.1.

Full changelog: https://github.com/voyvodka/web-launcher/blob/main/CHANGELOG.md

Follow-ups from a full re-audit. Every item is something 0.3.0 missed.

Fixed

• Two more checks passed on a dead origin. 0.3.0 fixed C1, C5 and C9 for this pattern. Sweeping every check against it found two more: C4 (hop_count) reported OK … 0 hop for an unreachable host — masking the dead-alias defect it exists to catch — and C7 (shell_leak_check) reported OK no shell leak when the origin never answered, because every size is then 0 and every code 000. Both now print ? not checked.
• 13-dependency-security.md still ran pnpm audit || npm audit. 0.3.0 fixed that exact line in 09-audit-workflow.md and left the sibling in the Mode B checklist. Audit tools exit non-zero when they find something, so on a pnpm project with a real CVE the fallback fired and ran npm audit against a lockfile it cannot read.
• The @vercel/og row in 07-og-satori.md said 1.0.1 while the prose two lines above said 1.0.2. The table is the block an agent quotes.
• A claim added in 0.3.0 — that Workers has no "deployment finished" event — carried no date and no source, which is what this skill's own rule 3 forbids. It now states what was checked and when, and marks the conclusion unverified: the docs document no such event, but an absence is not a denial.

Diagnostic correctness. If you run the check suite, upgrade.

Fixed — checks that reported success on a failing site

• C1 passed a direct 404. v0.2.0 added the 000 no-response branch and left the gap under it: a path that 404s without redirecting matched no branch, so the loop printed OK redirect targets resolve to 200. Only an explicit 200 at the end of the chain is a pass now.
• C5 reported a missing sitemap as a healthy one. A sitemap that 404'd, timed out or parsed to nothing produced zero iterations and then printed OK all sitemap URLs return 200. Zero URLs read is now ?, not a pass. C7 gained the same guard.

Fixed — a deploy baseline that generated soft-404s

not_found_handling: "single-page-application" sat unconditionally in the wrangler.jsonc every deploy path copies. On a multi-page site that serves the homepage with a 200 for every unknown route — and C1 cannot catch it, because the response really is 200. Now chosen from the site shape the scan phase already establishes.

Fixed — the POSIX promise

The README says the checks need a POSIX shell; two blocks used process substitution. Rewritten rather than softening the promise: every bash block in 14, 09, 11 and 08 now passes dash -n as well as bash -n.

Fixed — pnpm audit || npm audit ran both

Audit tools exit non-zero when they find something, so the fallback fired on a real vulnerability and ran the second scanner against a lockfile it does not understand. Now detects packageManager then lockfile and runs exactly one, bun included.

Also

• 03's meta template used favicon.svg for apple-touch-icon and Organization.logo while 01 and 10 say with sources that both must be raster.
• "Commit logically" now needs its own approval, alongside deploy, cache purge, sitemap submit and DNS changes — applying a change is not publishing it.
• Search Console defaults to the webmasters.readonly scope, and says plainly that it is a procedure rather than shipped client code.
• The checks that follow URLs out of fetched content (<loc>, og:image) now say what that means when the origin is not yours.

Content corrections found by a full re-audit on 2026-08-28, plus the repository's first CI gate.

Fixed

• Two action pins in 13-dependency-security.md could not resolve. The github/codeql-action v4 row gave a SHA absent from that repository entirely, so a workflow copying it failed to find the action rather than running a stale one. pnpm/action-setup v6 was pinned to the annotated tag object instead of its commit. Both came out of the resolution command the file itself recommended, which returns .object.sha without dereferencing annotated tags. The file now gives the one-step form and explains the trap.
• 06-agent-ready.md had the AIPREF status backwards. It described draft-ietf-aipref-attach as expired and told the reader to wait for it to revive. It revived as -05 on 2026-08-19 and runs to 2027-02-20; vocab moved to -07. Corrected in all three places it appeared. Nothing is known to parse Content-Usage yet, so it stays an intent-only signal.

Changed

• .mcp.json pins [email protected]; it previously ran npx -y geodaddy-mcp, so every session executed whatever the registry served as latest.
• Versions refreshed against the registries on 2026-08-28: satori 0.29.0 → 0.33.4, codeql-action → v4.37.9, TruffleHog → v3.97.1, Syft → v1.51.1, pnpm → 11.24.0. The satori jump spans four minor releases whose notes have not been read, so the CSS-support claims below it are marked not re-verified rather than carried forward silently.

Added

• CI that validates the manifest and checks the capability index against references/ in both directions — a row pointing at nothing and a reference nothing routes to are both breakage that manifest validation cannot see.
• Dependabot for the pinned action SHAs. This plugin recommends the practice; it now follows it.