qiksy 1.1.0 → 1.1.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qiksy",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "Qiksy \u2014 one local engine for every Qiksy tool (Work Finder, Travel Assistant, Client Finder). Runs on your own Claude; nothing leaves your machine.",
   "type": "module",
   "bin": {

package/tools/client-finder/vendor/lib/jobs.mjs

@@ -23,7 +23,12 @@ export function createJob(input) {
        had. Parsing log lines instead would leave the header one rewording away from
        lying again. */
     phase: 'starting', // starting | searching | verifying | done
-    input, // { productId, channels, brief, count, model }
+    /* { productId, kind, channels, brief, count, model, seeds? }
+       `kind` is which phase this is — 'scout' (wide, cheap, WebSearch only),
+       'dossier' (deep, on `seeds`) or 'full' (the old one-phase run). It decides
+       the prompt AND the tool list, so it is part of the run's identity rather
+       than a display flag. */
+    input,
     log: [],
     prospects: [],
     error: null,
@@ -53,6 +58,7 @@ export const listJobs = () =>
       id: j.id,
       status: j.status,
       brief: j.input.brief,
+      kind: j.input.kind || 'full',
       productId: j.input.productId,
       found: j.prospects.length,
       startedAt: j.startedAt,

package/tools/client-finder/vendor/lib/prompts.mjs

@@ -43,7 +43,118 @@ export function briefToIcp({ product, brief, channels = [], language }) {
   };
 }
 
+/**
+ * SCOUTING — the cheap half of a two-phase search.
+ *
+ * The expensive part of qualifying a prospect is not the thinking, it is the
+ * READING: a full dossier opens the homepage, the contact page and a product page,
+ * which is where the 50–150K input tokens per lead go. Paying that for candidates
+ * the seller would have crossed off at a glance is the single biggest waste in the
+ * old one-phase run — and it also meant five minutes of blank screen before the
+ * first name appeared.
+ *
+ * So scouting is capped by TOOL, not by instruction: the runner hands this pass
+ * `WebSearch` and nothing else. Without WebFetch the agent physically cannot walk
+ * sites, so "just check one page quickly" is not a temptation it can act on. What
+ * comes back is a name, a site and one honest line of why it might fit — enough to
+ * cross off the obvious misses, and nothing that pretends to be proof.
+ *
+ * `verified` still gets filled in for these rows, by lib/verify.mjs — plain HTTP,
+ * no model, no tokens. So a dead site is visible before anyone spends a cent on it.
+ */
+const SCOUT_SCHEMA = `{
+  "company": "name as written",
+  "url": "their own site, exactly as it appears in the result — never reconstructed",
+  "country": "ISO-2 if visible, else null",
+  "what_they_do": "one short line",
+  "why_maybe": "why this MIGHT fit the brief — a guess from the search result, stated as a guess",
+  "found_at": "the search result or listing page this came from"
+}`;
+
+export function scoutPrompt(/** @type {Icp} */ icp, count) {
+  return `${SCOPE_LOCK}
+
+You are SCOUTING — a fast, wide first pass. You produce a shortlist for a human to triage, not proof.
+
+# The product you are finding buyers for
+${icp.product.name} — ${icp.product.pitch}
+
+# Who counts as a candidate
+${icp.who}
+
+# How to work
+1. Search the public web: directories, marketplaces, "best X in Y" lists, industry catalogues, local business media, maps listings.
+2. Vary the query. Repeating one phrasing returns one slice of the market — search in the LOCAL LANGUAGE of the geography named in the brief as well as in English.
+3. Judge from the search results alone. You have no page-fetching tool in this pass, and that is deliberate: this is the cheap pass.
+4. Take the URL exactly as it appears. Never reconstruct or guess a URL — a guessed link is a fabricated source, and the next phase will fetch it for real.
+5. Skip aggregators, directories and marketplaces themselves. You want the businesses listed ON them.
+
+# Honesty
+"why_maybe" is a GUESS and must read like one. You have not opened their site, so you cannot claim their site lacks a chat, or that they use Shopify, unless the search result itself says so. Do not dress a guess as a finding — the seller decides what to pay to verify, and a confident-sounding guess corrupts that decision.
+
+# Output
+For each candidate, emit ONE line, nothing else on it:
+PROSPECT: {json}
+using exactly this shape:
+${SCOUT_SCHEMA}
+
+Find up to ${count}. Stop early rather than padding the list with candidates that plainly do not fit the brief.
+When done, output a final JSON array of everything you emitted in a \`\`\`json fence, then one sentence on where you searched and what you would look at next.`;
+}
+
+/**
+ * The DOSSIER pass — the expensive half, aimed only at what the seller ticked.
+ *
+ * Same evidence contract the one-phase run always had, with one addition that
+ * matters more than it looks: a candidate may come back REJECTED. Scouting guesses;
+ * this pass is where a guess is allowed to die, with a reason. A tool that silently
+ * dropped the ones that failed would look like it lost them, and the seller would
+ * never learn which of their own picks were wrong.
+ */
+export function dossierPrompt(/** @type {Icp} */ icp, prospects) {
+  const list = prospects
+    .map((p, i) => `${i + 1}. ${p.company} — ${p.url}${p.what_they_do ? ` (${p.what_they_do})` : ''}`)
+    .join('\n');
+  return `${SCOPE_LOCK}
+
+You are building DOSSIERS on candidates a human already picked. You do not search for new ones — this exact list, nothing added.
+
+# The product you are finding buyers for
+${icp.product.name} — ${icp.product.pitch}${icp.product.url ? `\nProduct page: ${icp.product.url}` : ''}
+
+# The brief they were picked against
+${icp.who}
+
+Must be true (every one of these):
+${icp.must.map((m) => `- ${m}`).join('\n')}
+${icp.mustNot?.length ? `\nMust NOT be true (check each and say you checked):\n${icp.mustNot.map((m) => `- ${m}`).join('\n')}` : ''}
+
+# The candidates
+${list}
+
+# How to work
+1. OPEN each one's own site with WebFetch. A search snippet is not evidence.
+2. Check every "must" against something you actually saw on a page. Cite the page each claim lives on, not the homepage for all of them.
+3. For "must not", say explicitly what you checked and did not find.
+4. Find a contact route and a decision-maker only if the site shows them. Never guess an email address; an inferred pattern is not a contact.
+5. Use URLs character for character as you fetched them. Do not reconstruct a page URL from a title — a guessed URL is a fabricated source, and it will be checked.
+
+# A candidate is allowed to fail
+If the site shows they do NOT match, return them with "verdict":"rejected" and say why in "why_not". That is a useful answer, not a failure — the human picked them from a guess and needs to know the guess was wrong. Never quietly drop a candidate from the list.
+If the site will not load at all, return "verdict":"unreachable" rather than judging it from search results.
+
+# Output
+As soon as one is finished, emit ONE line, nothing else on it:
+PROSPECT: {json}
+using exactly this shape:
+${SCHEMA}
+
+Do all ${prospects.length}. When done, output a final JSON array of all of them in a \`\`\`json fence.`;
+}
+
 const SCHEMA = `{
+  "verdict": "qualified | rejected | unreachable",
+  "why_not": "only when rejected or unreachable — one line, what the page showed",
   "company": "legal or trading name",
   "url": "the company's own site (homepage)",
   "country": "ISO-2, e.g. PL",

package/tools/client-finder/vendor/server.mjs

@@ -18,7 +18,7 @@ import { writeFileSync, mkdirSync } from 'node:fs';
 import { resolve, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { runClaude, extractJson } from './lib/agent.mjs';
-import { researchPrompt, briefToIcp, draftPrompt } from './lib/prompts.mjs';
+import { researchPrompt, scoutPrompt, dossierPrompt, briefToIcp, draftPrompt } from './lib/prompts.mjs';
 import { checkBrief } from './lib/scope.mjs';
 import { PRODUCTS, byId } from './lib/catalog.mjs';
 import { CHANNELS, needsBrowser } from './lib/channels.mjs';
@@ -68,15 +68,38 @@ const readBody = (req) =>
     });
   });
 
-/* ── the run ──────────────────────────────────────────────────────────────── */
+/* ── the run ──────────────────────────────────────────────────────────────────
+ * TWO PHASES, and the split is about money and about the first minute.
+ *
+ * The expensive part of qualifying a prospect is READING pages — that is where the
+ * 50–150K input tokens per lead go. A one-phase run paid that for every candidate,
+ * including the ones the seller would have crossed off at a glance, and showed
+ * nothing at all for the first several minutes.
+ *
+ *   SCOUT    wide and cheap. WebSearch ONLY — the tool list, not the wording, is
+ *            what keeps it cheap: without WebFetch the agent physically cannot walk
+ *            sites. Names and sites land in seconds.
+ *   DOSSIER  narrow and expensive, aimed only at what the seller ticked. WebFetch
+ *            is back, and so is the full evidence contract.
+ *
+ * Link verification runs in BOTH: it is plain HTTP, no model, no tokens — so a dead
+ * site is visible on a scout row before anyone pays to look into it.
+ */
 
 async function execute(job) {
   const product = byId(job.input.productId);
   const icp = briefToIcp({ product, brief: job.input.brief, channels: job.input.channels });
+  const seeds = job.input.seeds;
+  const isDossier = job.input.kind === 'dossier';
+  const isScout = job.input.kind === 'scout';
 
   job.phase = 'searching';
-  log(job, `Ищу покупателей для «${product.name}»`);
-  if (needsBrowser(job.input.channels)) {
+  if (isDossier) {
+    log(job, `Собираю досье: ${seeds.length} кандидат(ов), открываю их сайты`);
+  } else {
+    log(job, isScout ? `Разведка: ищу кандидатов для «${product.name}»` : `Ищу покупателей для «${product.name}»`);
+  }
+  if (!isDossier && needsBrowser(job.input.channels)) {
     // Browser channels are declared but not wired yet: say so out loud rather than
     // silently searching the open web and letting the picked channel imply more
     // than happened.
@@ -84,7 +107,15 @@ async function execute(job) {
   }
 
   const res = await runClaude({
-    prompt: researchPrompt(icp, job.input.count),
+    prompt: isDossier
+      ? dossierPrompt(icp, seeds)
+      : isScout
+        ? scoutPrompt(icp, job.input.count)
+        : researchPrompt(icp, job.input.count),
+    /* The cap that makes scouting cheap is the TOOL LIST, not the prompt. Take
+       WebFetch away and "let me just open one page to be sure" stops being a thing
+       the agent can do — which is the whole economic point of the phase. */
+    allowedTools: isScout ? ['WebSearch'] : ['WebSearch', 'WebFetch'],
     model: job.input.model,
     apiKey: job.input.apiKey,
     signal: job.controller.signal,
@@ -96,8 +127,12 @@ async function execute(job) {
        about it. On a product whose landing sells "проверенные ссылки" that is the
        worst possible silence. Pure HTTP: no model, no tokens. */
     onPartial: (p) => {
+      // How deeply this row was checked, recorded by the phase that produced it —
+      // never inferred from which fields happen to be filled. The panel gates
+      // "these are proven" on this and nothing else.
+      p.depth = isScout ? 'scout' : 'full';
       job.prospects.push(p);
-      log(job, `✅ ${job.prospects.length}. ${p.company}`);
+      log(job, `${isScout ? '👁' : '✅'} ${job.prospects.length}. ${p.company}`);
       void verifyProspect(p)
         .then((v) => Object.assign(p, { verified: v.verified }))
         .catch(() => {
@@ -147,6 +182,19 @@ async function execute(job) {
   const alreadyKnown = new Map(job.prospects.filter((p) => p.verified).map((p) => [p.url, p.verified]));
   for (const p of prospects) {
     if (!p.verified && alreadyKnown.has(p.url)) p.verified = alreadyKnown.get(p.url);
+    if (!p.depth) p.depth = isScout ? 'scout' : 'full';
+  }
+
+  /* A dossier answers about a FIXED list, so anything the agent silently left out is
+     a hole in the seller's board — they ticked that row and would be left staring at
+     a scout entry that never changed. Missing ones come back as unreachable, which
+     is the honest word for "we cannot say". */
+  if (isDossier) {
+    const answered = new Set(prospects.map((p) => p.url));
+    for (const seed of seeds) {
+      if (answered.has(seed.url)) continue;
+      prospects.push({ ...seed, depth: 'full', verdict: 'unreachable', why_not: 'Агент не вернул досье по этому кандидату' });
+    }
   }
 
   job.phase = 'verifying';
@@ -273,6 +321,10 @@ const server = createServer(async (req, res) => {
 
       const job = createJob({
         productId: product.id,
+        /* Scouting is the default entry point: cheap, wide, and on screen in
+           seconds. `full` stays reachable for someone who knows their brief is
+           tight enough to pay for depth straight away. */
+        kind: body.mode === 'full' ? 'full' : 'scout',
         channels: Array.isArray(body.channels) && body.channels.length ? body.channels : ['web'],
         brief: String(body.brief).trim(),
         /* Only a REAL key travels on. Anything else — a placeholder from a stale
@@ -294,6 +346,56 @@ const server = createServer(async (req, res) => {
     }
 
 
+    /* ── dossier: phase two ───────────────────────────────────────────────────
+     * The seller ticked some scout rows; this is where those — and ONLY those —
+     * get their pages opened and their evidence collected.
+     *
+     * It takes the candidates in the REQUEST rather than reading them out of a
+     * job id, and that is deliberate: runs live in memory here and in the browser's
+     * storage over there, so a backend restart would otherwise turn every board
+     * older than the process into a dead "collect dossier" button. The panel owns
+     * the list, this endpoint owns the work.
+     */
+    if (req.method === 'POST' && path === '/api/dossier') {
+      const body = await readBody(req);
+      const access = await checkPartner(body.partner, body.account);
+      if (!access.ok) return json(res, 403, { reason: 'Доступ только для партнёров', hint: access.reason });
+      const product = byId(body.productId);
+      if (!product) return json(res, 400, { error: 'Выберите продукт из списка' });
+
+      const seeds = (Array.isArray(body.prospects) ? body.prospects : [])
+        .map((p) => ({
+          company: String(p?.company || '').slice(0, 200),
+          url: String(p?.url || '').slice(0, 500),
+          what_they_do: String(p?.what_they_do || '').slice(0, 300),
+        }))
+        .filter((p) => p.company && /^https?:\/\//i.test(p.url))
+        // One page-walking agent over twenty companies is already a long run; past
+        // that the seller is better served by a second batch they can watch.
+        .slice(0, 20);
+      if (!seeds.length) return json(res, 400, { error: 'Некого проверять — отметьте кандидатов' });
+
+      const guard = checkBrief(body.brief);
+      if (!guard.ok) return json(res, 422, guard);
+
+      const job = createJob({
+        productId: product.id,
+        kind: 'dossier',
+        seeds,
+        channels: Array.isArray(body.channels) && body.channels.length ? body.channels : ['web'],
+        brief: String(body.brief).trim(),
+        apiKey: typeof body.apiKey === 'string' && isRealKey(body.apiKey) ? body.apiKey : '',
+        count: seeds.length,
+        model: body.model === 'opus' ? 'opus' : 'sonnet',
+      });
+      execute(job).catch((e) => {
+        job.status = 'failed';
+        job.error = e.message;
+        job.finishedAt = Date.now();
+      });
+      return json(res, 200, view(job));
+    }
+
     /* ── drafts ───────────────────────────────────────────────────────────────
      * A separate, cheap pass over prospects we already verified: no web tools, no
      * second search. That also makes re-drafting the same list for another
@@ -303,13 +405,22 @@ const server = createServer(async (req, res) => {
       const body = await readBody(req);
       const access = await checkPartner(body.partner, body.account);
       if (!access.ok) return json(res, 403, { error: access.reason });
+      /* The panel may send the candidates outright, and when it does they WIN over
+         anything held here. Two reasons, both of which used to bite: runs live in
+         memory on this side, so a restart made every older board unwritable; and a
+         row enriched by a dossier lives in the panel's storage under its original
+         run, so reading it back from that run's job would draft from the thin scout
+         version of a prospect the seller already paid to prove. */
       const job = getJob(body.jobId);
-      if (!job) return json(res, 404, { error: 'нет такого прогона' });
-      const product = byId(job.input.productId);
+      const sent = Array.isArray(body.prospects) ? body.prospects.filter((p) => p?.company && p?.url) : [];
+      if (!job && !sent.length) return json(res, 404, { error: 'нет такого прогона' });
+      const product = byId(body.productId ?? job?.input.productId);
+      if (!product) return json(res, 400, { error: 'Выберите продукт из списка' });
       const format = formatById(body.format);
-      const picked = Array.isArray(body.indexes) && body.indexes.length
-        ? body.indexes.map((i) => job.prospects[i]).filter(Boolean)
-        : job.prospects;
+      const pool = sent.length ? sent : job.prospects;
+      const picked = Array.isArray(body.indexes) && body.indexes.length && !sent.length
+        ? body.indexes.map((i) => pool[i]).filter(Boolean)
+        : pool;
       if (!picked.length) return json(res, 400, { error: 'нечего писать — список пуст' });
 
       const out = await runClaude({
@@ -321,13 +432,13 @@ const server = createServer(async (req, res) => {
           language: body.language,
           platform: body.platform,
         }),
-        model: job.input.model,
+        model: body.model === 'opus' ? 'opus' : job?.input.model || 'sonnet',
         /* Same rule, and the job's own key as the fallback — it was filtered by the
            same check when the run started. */
         apiKey:
           typeof body.apiKey === 'string' && isRealKey(body.apiKey)
             ? body.apiKey
-            : job.input.apiKey || '',
+            : job?.input.apiKey || '',
         // Drafting reads what we already proved; giving it the web again would
         // invite it to "check something" and pay for a second research run.
         allowedTools: [],

package/tools/travel/vendor/lib/license.mjs

@@ -4,7 +4,7 @@
  * Local-first: paid tiers are unlocked by a key validated HERE, not by the plan
  * stored in the user's own db.json. Best-effort + offline-grace cache.
  */
-const LICENSE_API = (process.env.QIKSY_LICENSE_API || 'https://qiksy-licenses.qiksy.workers.dev').replace(/\/+$/, '');
+export const LICENSE_API = (process.env.QIKSY_LICENSE_API || 'https://qiksy-licenses.qiksy.workers.dev').replace(/\/+$/, '');
 const PRODUCT = 'travel';
 export const RECHECK_MS = 6 * 3600 * 1000;
 export const OFFLINE_GRACE_MS = 7 * 86400 * 1000;

package/tools/travel/vendor/server.mjs

@@ -18,7 +18,7 @@ import { buildSearchPrompt, buildBookPrompt, buildFinalizePrompt } from './lib/p
 import { createJob, jobLog, jobStep, listJobs, getJob, cancelJob, cancelActiveByTrip } from './lib/jobs.mjs';
 import { ensureBrowser } from './scripts/launch-browser.mjs';
 import { PLANS, SELF_SETTABLE_PLANS } from './lib/plans.mjs';
-import { verifyLicense, licensePlanId, RECHECK_MS } from './lib/license.mjs';
+import { verifyLicense, licensePlanId, RECHECK_MS, LICENSE_API } from './lib/license.mjs';
 import { probeEngine, startLogin, submitLoginCode } from './lib/engine.mjs';
 import { buildProposalHtml } from './lib/proposal.mjs';
 
@@ -587,6 +587,50 @@ const server = createServer(async (req, res) => {
       return json(res, 200, db.settings);
     }
 
+    /* Лицензия по АККАУНТУ: тот, кто вошёл в студию, не должен копировать ключ из
+       письма — его почта уже подтверждена, а воркер по этой почте знает ключ (решение
+       владельца 26.07.2026). Фронт присылает ref_code+token, которые студия и так
+       раздаёт приложениям; воркер валидирует их так же, как /account/me. */
+    if (req.method === 'POST' && path === '/api/license/auto') {
+      const { ref_code, token } = await readBody(req);
+      if (!ref_code || !token) return json(res, 400, { error: 'нужны ref_code и token' });
+      // Уже есть рабочий ключ — не трогаем: человек мог ввести другой руками.
+      if (db.settings.license && licensePlanId(db.settings.licenseInfo) !== 'free') {
+        return json(res, 200, { ok: true, already: true, billing: billingInfo() });
+      }
+      try {
+        const r = await fetch(
+          `${LICENSE_API}/licenses/mine?ref_code=${encodeURIComponent(ref_code)}&token=${encodeURIComponent(token)}&product=travel`,
+          { signal: AbortSignal.timeout(6000) }
+        );
+        const j = await r.json().catch(() => ({}));
+        if (!j.key) return json(res, 200, { ok: true, key: '', billing: billingInfo() });
+        db.settings.license = j.key;
+        db.settings.licenseInfo = null;
+        save(db);
+        await refreshLicense();
+        return json(res, 200, { ok: true, key: j.key.slice(0, 6) + '…', billing: billingInfo() });
+      } catch {
+        return json(res, 200, { ok: false, billing: billingInfo() });
+      }
+    }
+
+    /* Ключ ушёл в письмо, письмо потерялось — попросить его ещё раз. Воркер отвечает
+       200 всегда (не раскрывает, есть ли лицензия у этой почты). */
+    if (req.method === 'POST' && path === '/api/license/resend') {
+      const { email } = await readBody(req);
+      if (!email) return json(res, 400, { error: 'нужен email' });
+      try {
+        await fetch(`${LICENSE_API}/resend`, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ email, product: 'travel' }),
+          signal: AbortSignal.timeout(6000),
+        });
+      } catch { /* сеть — фронт всё равно скажет «если ключ есть, письмо придёт» */ }
+      return json(res, 200, { ok: true });
+    }
+
     // ── license: ввести/сменить/убрать ключ и сразу проверить у воркера ──
     if (req.method === 'POST' && path === '/api/license') {
       const { key } = await readBody(req);

package/tools/work-finder/vendor/server.mjs

@@ -839,6 +839,20 @@ export const requestHandler = async (req, res) => {
       logCost('Сбор профиля из рассказа', r.costUsd);
       return json(res, 200, { profile: parsed, gaps: Array.isArray(parsed.gaps) ? parsed.gaps : [], costUsd: r.costUsd });
     }
+    /* The builder's other three AI actions (parse a pasted résumé, write a summary,
+       polish it) used to call Anthropic straight from the browser with a key kept in
+       localStorage. That key cannot exist any more — API_KEY_LOGIN is off and there is
+       no field to enter one — so all three were dead for every user while the fourth,
+       which comes through here, worked. Same route for all of them now. */
+    if (req.method === 'POST' && path === '/api/builder/text') {
+      const b = await readBody(req);
+      const prompt = (b.prompt || '').trim();
+      if (!prompt) return json(res, 400, { error: 'empty prompt' });
+      const r = await runClaude({ prompt, model: db.settings.model });
+      if (!r.ok) return json(res, 502, { error: r.error || 'claude failed' });
+      logCost(b.label || 'Конструктор резюме', r.costUsd);
+      return json(res, 200, { text: r.result || '', costUsd: r.costUsd });
+    }
     if (req.method === 'PATCH' && seg[1] === 'positions' && seg[2]) {
       const p = db.positions.find(x => x.id === seg[2]);
       if (!p) return json(res, 404, { error: 'no such position' });