fix(website): keep crawler smoke checks deployable

Author: steipete

CHANGELOG.md

@@ -21,6 +21,7 @@
 - Added a release-prep checklist for auditing changelog, package metadata, and dry-run package contents without publishing.
 - Improved bounded source grouping so large flat directories split repeated filename families like command, plugin, doctor, and runtime files into more coherent review slices.
 - Fixed acpx provider error reporting by reading the terminal `result.stopReason` envelope and surfacing non-`end_turn` reasons as typed `ClawpatchError` codes (`agent-cancelled`, `agent-refused`, `agent-truncated`) instead of opaque `malformed-output`, thanks @coletebou.
+- Added website crawler artifacts and a static smoke check for metadata, anchors, and social-card dimensions, thanks @zack-dev-cm.
 - Improved OpenCode malformed JSON diagnostics with output length, event kinds, and a bounded preview, thanks @rohitjavvadi.
 - Fixed finding signatures so equivalent evidence remains stable across re-reviews, thanks @rohitjavvadi.
 - Fixed provider exit-code classification for stdout-only authentication and quota failures, thanks @rohitjavvadi.

scripts/website-smoke.mjs

@@ -38,7 +38,6 @@ function extractFirst(html, pattern, label) {
 const html = await mustRead("website/index.html");
 const robots = await mustRead("website/robots.txt");
 const sitemap = await mustRead("website/sitemap.xml");
-const headers = await mustRead("website/_headers");
 
 const title = stripTags(extractFirst(html, /<title>([\s\S]*?)<\/title>/iu, "title"));
 if (title !== "Clawpatch — Automated Code Review") {
@@ -69,19 +68,6 @@ if (!sitemap.includes("<loc>https://clawpatch.ai/</loc>")) {
   fail("sitemap.xml missing canonical homepage loc");
 }
 
-for (const expectedHeader of [
-  "Strict-Transport-Security",
-  "X-Content-Type-Options",
-  "X-Frame-Options",
-  "Referrer-Policy",
-  "Permissions-Policy",
-  "Content-Security-Policy",
-]) {
-  if (!headers.includes(expectedHeader)) {
-    fail(`_headers missing ${expectedHeader}`);
-  }
-}
-
 const socialCard = await readFile(join(website, "social-card.png"));
 if (socialCard.toString("ascii", 1, 4) !== "PNG") {
   fail("social-card.png is not a PNG");

website/README.md

@@ -10,7 +10,6 @@ Files:
 - `social-card.png`: raster link preview card for Open Graph/Twitter
 - `robots.txt`: crawler policy with sitemap reference
 - `sitemap.xml`: canonical single-page sitemap
-- `_headers`: static security headers for hosts that support header files
 
 Preview: