sproutkit-code 0.8.0 → 0.10.0

package/dist/index.js

@@ -187,6 +187,10 @@ var require_db = __commonJS({
         db2.exec("ALTER TABLE leads ADD COLUMN dead_at TEXT");
       } catch {
       }
+      try {
+        db2.exec("ALTER TABLE leads ADD COLUMN site_uid TEXT");
+      } catch {
+      }
     }
     function getDb2() {
       return db2;
@@ -32728,6 +32732,12 @@ var require_cms_runtime = __commonJS({
     exports2.hashPassword = hashPassword;
     exports2.generateSessionSecret = generateSessionSecret;
     exports2.API_CONTENT_JS = `import { list, put } from "@vercel/blob";
+
+// Per-site Blob namespace so many CMS sites share one store (one token per
+// agency) without overwriting each other's content. Empty when SITE_ID unset \u2192
+// legacy sites keep the flat content.json key, so nothing deployed breaks.
+const PFX = process.env.SITE_ID ? "sites/" + process.env.SITE_ID + "/" : "";
+const CONTENT_KEY = PFX + "content.json";
 import { createHmac, timingSafeEqual } from "node:crypto";
 
 // Runs on Node.js (not Edge) because @vercel/blob's undici dependency
@@ -32795,8 +32805,8 @@ function sanitise(raw) {
 
 async function readContent() {
   try {
-    const { blobs } = await list({ prefix: "content.json", limit: 1 });
-    const target = blobs.find((b) => b.pathname === "content.json");
+    const { blobs } = await list({ prefix: CONTENT_KEY, limit: 1 });
+    const target = blobs.find((b) => b.pathname === CONTENT_KEY);
     if (!target) return SAFE_DEFAULTS;
     const res = await fetch(target.url);
     if (!res.ok) return SAFE_DEFAULTS;
@@ -32864,7 +32874,7 @@ export default async function handler(req, res) {
         body = raw ? JSON.parse(raw) : null;
       }
       const clean = sanitise(body);
-      await put("content.json", JSON.stringify(clean), {
+      await put(CONTENT_KEY, JSON.stringify(clean), {
         access: "public",
         addRandomSuffix: false,
         allowOverwrite: true,
@@ -32988,6 +32998,10 @@ export default function handler(req, res) {
 
 export const config = { runtime: "nodejs", api: { bodyParser: false } };
 
+// Per-site namespace so uploaded photos don't collide across sites sharing one
+// Blob store. Empty when SITE_ID unset (legacy sites keep flat photos/ path).
+const PFX = process.env.SITE_ID ? "sites/" + process.env.SITE_ID + "/" : "";
+
 async function verifySession(req) {
   const cookie = req.headers.cookie || "";
   const match = cookie.match(/sk_admin=([^;]+)/);
@@ -33036,7 +33050,7 @@ export default async function handler(req, res) {
       res.status(413).json({ error: "too_large" });
       return;
     }
-    const name = "photos/" + Date.now() + "-" + Math.random().toString(36).slice(2, 8) + ".webp";
+    const name = PFX + "photos/" + Date.now() + "-" + Math.random().toString(36).slice(2, 8) + ".webp";
     const blob = await put(name, buf, {
       access: "public",
       addRandomSuffix: false,
@@ -33804,6 +33818,13 @@ import { createHmac, timingSafeEqual } from "node:crypto";
 
 export const config = { runtime: "nodejs" };
 
+// Per-site Blob namespace: every site isolates its files under sites/<id>/ so
+// many booking sites can share ONE Blob store (one token per agency) without
+// overwriting each other. Empty when SITE_ID is unset \u2192 older sites keep
+// reading/writing the legacy flat keys, so nothing already deployed breaks.
+const PFX = process.env.SITE_ID ? "sites/" + process.env.SITE_ID + "/" : "";
+const CONFIG_KEY = PFX + "booking-config.json";
+
 const SAFE_DEFAULTS = {
   archetype: "enquiry",
   services: [],
@@ -33856,8 +33877,8 @@ function sanitise(raw) {
 
 async function readConfig() {
   try {
-    const { blobs } = await list({ prefix: "booking-config.json", limit: 1 });
-    const target = blobs.find((b) => b.pathname === "booking-config.json");
+    const { blobs } = await list({ prefix: CONFIG_KEY, limit: 1 });
+    const target = blobs.find((b) => b.pathname === CONFIG_KEY);
     if (!target) return SAFE_DEFAULTS;
     const res = await fetch(target.url);
     if (!res.ok) return SAFE_DEFAULTS;
@@ -33912,7 +33933,7 @@ export default async function handler(req, res) {
         body = raw ? JSON.parse(raw) : null;
       }
       const clean = sanitise(body);
-      await put("booking-config.json", JSON.stringify(clean), {
+      await put(CONFIG_KEY, JSON.stringify(clean), {
         access: "public", addRandomSuffix: false, allowOverwrite: true,
         contentType: "application/json",
       });
@@ -33930,6 +33951,10 @@ import { createHmac, timingSafeEqual } from "node:crypto";
 
 export const config = { runtime: "nodejs" };
 
+// Per-site namespace (see booking-config.js). Empty when SITE_ID unset.
+const PFX = process.env.SITE_ID ? "sites/" + process.env.SITE_ID + "/" : "";
+const BOOKINGS_KEY = PFX + "bookings.jsonl";
+
 function verifySession(req) {
   const cookie = req.headers.cookie || "";
   const match = cookie.match(/sk_admin=([^;]+)/);
@@ -33959,8 +33984,8 @@ function readBody(req) {
 
 async function readAllBookings() {
   try {
-    const { blobs } = await list({ prefix: "bookings.jsonl", limit: 1 });
-    const target = blobs.find((b) => b.pathname === "bookings.jsonl");
+    const { blobs } = await list({ prefix: BOOKINGS_KEY, limit: 1 });
+    const target = blobs.find((b) => b.pathname === BOOKINGS_KEY);
     if (!target) return [];
     const res = await fetch(target.url);
     if (!res.ok) return [];
@@ -33975,7 +34000,7 @@ async function readAllBookings() {
 
 async function writeAllBookings(bookings) {
   const text = bookings.map((b) => JSON.stringify(b)).join("\\n");
-  await put("bookings.jsonl", text, {
+  await put(BOOKINGS_KEY, text, {
     access: "public", addRandomSuffix: false, allowOverwrite: true,
     contentType: "application/x-ndjson",
   });
@@ -79485,7 +79510,9 @@ var require_builder = __commonJS({
     exports2.deployStandaloneBooking = deployStandaloneBooking2;
     var sdk_1 = __importDefault(require_sdk());
     var axios_1 = __importDefault(require_axios());
+    var crypto_1 = require("crypto");
     var runtime_1 = require_runtime();
+    var db_1 = require_db();
     var llm_1 = require_llm();
     var fs3 = __importStar(require("fs"));
     var path3 = __importStar(require("path"));
@@ -79493,6 +79520,15 @@ var require_builder = __commonJS({
     var cms_template_1 = require_cms_template();
     var cms_runtime_1 = require_cms_runtime();
     var booking_runtime_1 = require_booking_runtime();
+    function siteUidFor(leadId) {
+      const db2 = (0, db_1.getDb)();
+      const row = db2.get("SELECT site_uid FROM leads WHERE id = ?", [leadId]);
+      if (row?.site_uid)
+        return row.site_uid;
+      const uid = (0, crypto_1.randomUUID)();
+      db2.run("UPDATE leads SET site_uid = ? WHERE id = ?", [uid, leadId]);
+      return uid;
+    }
     var STOCK_HOSTS = [
       "unsplash.com",
       "images.unsplash.com",
@@ -80058,6 +80094,7 @@ export default defineConfig({ plugins: [react()] });`;
         devDependencies: { "@vitejs/plugin-react": "^4.3.1", vite: "^5.4.2" }
       }) : packageJson;
       if (includeCms) {
+        const cmsSiteUid = siteUidFor(lead.id);
         onProgress(reuseAdminPassword ? "Reusing existing credentials\u2026" : "Generating admin credentials\u2026");
         const adminPassword = reuseAdminPassword ?? (0, cms_runtime_1.generateFriendlyPassword)();
         const adminHash = await (0, cms_runtime_1.hashPassword)(adminPassword);
@@ -80092,7 +80129,7 @@ export default defineConfig({ plugins: [react()] });`;
           onProgress("Seeding CMS content\u2026");
           try {
             const { put } = await Promise.resolve().then(() => __importStar(require_dist5()));
-            await put("content.json", JSON.stringify(initialContent), {
+            await put(`sites/${cmsSiteUid}/content.json`, JSON.stringify(initialContent), {
               access: "public",
               addRandomSuffix: false,
               allowOverwrite: true,
@@ -80107,6 +80144,9 @@ export default defineConfig({ plugins: [react()] });`;
         onProgress("Setting CMS env vars\u2026");
         await setProjectEnv(projectName, vercelToken, {
           BLOB_READ_WRITE_TOKEN: blobToken,
+          // Namespaces this site's Blob files so it never collides with other
+          // sites sharing the same store/token.
+          SITE_ID: cmsSiteUid,
           ADMIN_PASSWORD_HASH: adminHash,
           SESSION_SECRET: sessionSecret,
           BUSINESS_NAME: lead.name
@@ -80224,12 +80264,16 @@ export default defineConfig({ plugins: [react()] });`;
         throw new Error("Couldn't fetch src/App.jsx from the existing deployment. Try Regenerate website first, then Redeploy CMS.");
       }
       onProgress("Refreshing CMS env vars\u2026");
-      await setProjectEnv(projectName, vercelToken, {
+      const existingUid = (0, db_1.getDb)().get("SELECT site_uid FROM leads WHERE id = ?", [lead.id])?.site_uid;
+      const cmsEnv = {
         BLOB_READ_WRITE_TOKEN: blobToken,
         ADMIN_PASSWORD_HASH: adminHash,
         SESSION_SECRET: sessionSecret,
         BUSINESS_NAME: lead.name
-      });
+      };
+      if (existingUid)
+        cmsEnv.SITE_ID = existingUid;
+      await setProjectEnv(projectName, vercelToken, cmsEnv);
       onProgress("Deploying\u2026");
       const res = await postVercelDeployment({
         name: projectName,
@@ -80293,10 +80337,12 @@ createRoot(document.getElementById('root')).render(<StrictMode><App /></StrictMo
 import react from '@vitejs/plugin-react';
 export default defineConfig({ plugins: [react()] });`;
       files.push({ file: "index.html", data: indexHtml, encoding: "utf-8" }, { file: "src/main.jsx", data: mainJsx, encoding: "utf-8" }, { file: "vite.config.js", data: viteConfig, encoding: "utf-8" });
+      const bookingExistingUid = (0, db_1.getDb)().get("SELECT site_uid FROM leads WHERE id = ?", [lead.id])?.site_uid;
+      const bookingKey = bookingExistingUid ? `sites/${bookingExistingUid}/booking-config.json` : "booking-config.json";
       onProgress("Seeding booking config into Blob\u2026");
       try {
         const { put } = await Promise.resolve().then(() => __importStar(require_dist5()));
-        await put("booking-config.json", JSON.stringify(bookingConfig), {
+        await put(bookingKey, JSON.stringify(bookingConfig), {
           access: "public",
           addRandomSuffix: false,
           allowOverwrite: true,
@@ -80307,19 +80353,25 @@ export default defineConfig({ plugins: [react()] });`;
         throw new Error(`Failed to seed booking config: ${e.message}`);
       }
       onProgress("Setting booking env vars\u2026");
-      await setProjectEnv(projectName, vercelToken, {
+      const bookingEnv = {
         RESEND_API_KEY: resendKey,
         OWNER_EMAIL: ownerEmail,
         BUSINESS_NAME: lead.name
-      });
+      };
+      if (bookingExistingUid)
+        bookingEnv.SITE_ID = bookingExistingUid;
+      await setProjectEnv(projectName, vercelToken, bookingEnv);
       if (lead.admin_password) {
         onProgress("Refreshing admin session env\u2026");
         const adminHash = await (0, cms_runtime_1.hashPassword)(lead.admin_password);
-        await setProjectEnv(projectName, vercelToken, {
+        const adminEnv = {
           BLOB_READ_WRITE_TOKEN: blobToken,
           ADMIN_PASSWORD_HASH: adminHash,
           SESSION_SECRET: (0, cms_runtime_1.generateSessionSecret)()
-        });
+        };
+        if (bookingExistingUid)
+          adminEnv.SITE_ID = bookingExistingUid;
+        await setProjectEnv(projectName, vercelToken, adminEnv);
       }
       const packageJsonBooking = JSON.stringify({
         name: "sprout-site",
@@ -80378,9 +80430,10 @@ export default defineConfig({ plugins: [react()] });`;
       const slug = lead.name.toLowerCase().replace(/[^a-z0-9]/g, "-").replace(/-+/g, "-").slice(0, 26);
       const projectName = `sprout-book-${lead.id}-${slug}`;
       onProgress("Seeding booking config\u2026");
+      const standaloneSiteUid = siteUidFor(lead.id);
       try {
         const { put } = await Promise.resolve().then(() => __importStar(require_dist5()));
-        await put("booking-config.json", JSON.stringify(bookingConfig), {
+        await put(`sites/${standaloneSiteUid}/booking-config.json`, JSON.stringify(bookingConfig), {
           access: "public",
           addRandomSuffix: false,
           allowOverwrite: true,
@@ -80395,7 +80448,8 @@ export default defineConfig({ plugins: [react()] });`;
         RESEND_API_KEY: resendKey,
         OWNER_EMAIL: ownerEmail,
         BUSINESS_NAME: lead.name,
-        BLOB_READ_WRITE_TOKEN: blobToken
+        BLOB_READ_WRITE_TOKEN: blobToken,
+        SITE_ID: standaloneSiteUid
       });
       const files = [
         { file: "index.html", data: booking_runtime_1.BOOK_INDEX_HTML, encoding: "utf-8" },
@@ -82456,7 +82510,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "sproutkit-code",
-      version: "0.8.0",
+      version: "0.10.0",
       description: "Sproutkit in your terminal \u2014 find leads, build sites, run outreach, all via chat.",
       bin: {
         sproutkit: "./dist/index.js"
@@ -82529,7 +82583,8 @@ var REQUIRED_KEYS = [
   { key: "anthropic_key", label: "Anthropic API key", hint: "sk-ant-\u2026 \u2014 powers the chat + site generation", required: true, apiBackendOnly: true },
   { key: "places_key", label: "Google Places API key", hint: "finds businesses, photos, reviews", required: true },
   { key: "vercel_token", label: "Vercel token", hint: "deploys the generated sites", required: true },
-  { key: "blob_token", label: "Vercel Blob token", hint: "optional \u2014 only needed for CMS/booking hand-off", required: false }
+  { key: "blob_token", label: "Vercel Blob token", hint: "required for booking sites & CMS (stores form config/submissions)", required: false },
+  { key: "resend_key", label: "Resend API key", hint: "optional \u2014 emails the business owner when a booking comes in", required: false }
 ];
 function getSetting(key) {
   const row = getDb().get("SELECT value FROM settings WHERE key = ?", [key]);
@@ -83029,7 +83084,7 @@ function makeInvokeIpc(emit) {
       const resendKey = getSetting("resend_key");
       if (!anthropicKey) throw new Error("Anthropic API key not set");
       if (!vercelToken) throw new Error("Vercel token not set");
-      if (!blobToken) throw new Error("Vercel Blob token not set");
+      if (!blobToken) throw new Error("Booking sites need a Vercel Blob token (stores the form config & submissions). Add one with 'sproutkit setup' \u2014 create a Blob store at vercel.com, copy its read-write token.");
       emit("bookings:progress", { leadId: p.leadId, msg: "Designing the booking form\u2026" });
       const leadInfo = lead;
       const config = await generatePreset({
@@ -83070,7 +83125,7 @@ function makeInvokeIpc(emit) {
       const blobToken = getSetting("blob_token");
       const resendKey = getSetting("resend_key");
       if (!vercelToken) throw new Error("Vercel token not set");
-      if (!blobToken) throw new Error("Vercel Blob token not set");
+      if (!blobToken) throw new Error("Booking sites need a Vercel Blob token (stores the form config & submissions). Add one with 'sproutkit setup' \u2014 create a Blob store at vercel.com, copy its read-write token.");
       emit("bookings:progress", { leadId: p.leadId, msg: "Designing the booking form\u2026" });
       const leadInfo = lead;
       const config = await generatePreset({
@@ -83742,8 +83797,36 @@ async function cmdBuildAll(argv) {
 
 // src/claude-bridge.ts
 var import_child_process3 = require("child_process");
+var TASK_SYSTEM_PROMPT = `You operate the "sproutkit" CLI on the user's behalf. Sproutkit finds local businesses without websites, builds them demo sites, adds booking, and prepares outreach.
+
+HOW TO ACT \u2014 this is strict:
+- Fulfil each request by running the matching sproutkit command(s) via Bash. Nothing else.
+- Do NOT read, list, or explore the repo. Do NOT narrate a plan, think out loud, or look for a skill. No preamble, no "let me\u2026". Either ask a crisp question (below) or run the command.
+- Always pass --json and parse it. When an action completes, report the outcome in ONE short line (what happened + the URL/result).
+- Get lead ids from \`sproutkit list --json\` \u2014 never guess an id.
+
+GATHER REQUIRED CHOICES FIRST \u2014 ask, don't guess, don't chatter:
+When a request is missing information the command needs, ask a SHORT, STRUCTURED question that lists the options \u2014 then wait. Present choices as a tight numbered/bulleted list, no rambling. Specifically:
+- Which business/lead is not clear \u2192 run \`sproutkit list --json\`, then ask: "Which business?" and list a few (id + name).
+- "make/build a booking site" \u2192 you MUST establish the booking TYPE before running. Ask: "What type of booking site?" and present exactly:
+    1. Slot-based \u2014 timed appointments (barbers, salons, clinics)
+    2. Reservation \u2014 table / party booking (restaurants, cafes)
+    3. Enquiry \u2014 a simple request/contact form
+  Also ask whether it should be standalone (its own URL, for a client who already has a website) or added to a Sproutkit-built site. Then run \`sproutkit book <id> --archetype <slots|reservation|enquiry> [--standalone] --json\`.
+- Once you have the needed choices, act immediately \u2014 one command, one line of result. Don't re-confirm what they already told you.
+
+COMMANDS:
+- sproutkit find "<area>" --categories "<type>,<type>" --json   \u2014 find leads
+- sproutkit list --json [--status <s>] [--city <c>]             \u2014 list leads (get ids)
+- sproutkit build <id> --json [--instructions "..."] [--cms]    \u2014 build a demo site
+- sproutkit build-all --json [--ids 3,5] [--concurrency 3]      \u2014 build many at once
+- sproutkit book <id> --json [--standalone] [--instructions "..."] [--archetype slots|reservation|enquiry] [--email x@y.com]  \u2014 booking site (--standalone = its own URL for clients who already have a website)
+- sproutkit outreach --json [--ids 3,5]                         \u2014 prepare outreach links
+
+If no command fits the request, say so in one line and name the closest thing you can do. Never invent results.`;
+var FREE_SYSTEM_PROMPT = `You are Sproutkit's assistant, talking with the user about their lead-generation and website work. You can run the sproutkit CLI (find, list, build, build-all, book, outreach \u2014 all support --json) via Bash, and you can help with small custom changes and questions. Be conversational and helpful, but stay within Sproutkit's domain (leads, demo sites, booking, outreach). You don't need to collapse everything to a single command here \u2014 it's fine to discuss, then act.`;
 function runClaudeTurn(args) {
-  const { message, sessionId, write } = args;
+  const { message, sessionId, write, freeMode } = args;
   const timeoutMs = args.timeoutMs ?? 6e5;
   const cliArgs = [
     "-p",
@@ -83752,6 +83835,11 @@ function runClaudeTurn(args) {
     "--include-partial-messages",
     "--verbose",
     // required for stream_event emission
+    // Inject the operating instructions directly so behaviour is precise and
+    // doesn't depend on flaky skill discovery. Task mode pins exact commands;
+    // free mode allows open conversation.
+    "--append-system-prompt",
+    freeMode ? FREE_SYSTEM_PROMPT : TASK_SYSTEM_PROMPT,
     // Let Claude drive the sproutkit CLI without hanging on a permission
     // prompt, but ONLY the sproutkit command — nothing else runs unattended.
     "--allowedTools",
@@ -83950,20 +84038,37 @@ async function main() {
   if (bridged && !skillInstalled()) {
     say(c.amber("  Tip: run 'sproutkit setup' to install the Sproutkit skill so Claude can find/build/book for you."));
   }
-  say(
-    bridged ? c.dim("  Talk to Sproutkit (powered by your Claude subscription). Type a request, or 'exit'.") : c.dim("  Chat with Sproutkit. Type a request, or 'exit' to quit.")
-  );
+  if (bridged) {
+    say(c.dim("  Talk to Sproutkit (powered by your Claude subscription). Type a request, or 'exit'."));
+    say(c.dim("  It runs the right action precisely. Type '/freemode' for open conversation + custom tweaks."));
+  } else {
+    say(c.dim("  Chat with Sproutkit. Type a request, or 'exit' to quit."));
+  }
   say();
   let claudeSession = null;
+  let freeMode = false;
   while (true) {
     const line = await ask(c.greenBold("sproutkit \u203A "));
     if (!line) continue;
     if (line === "exit" || line === "quit") break;
+    if (bridged && (line === "/freemode" || line === "/free")) {
+      freeMode = true;
+      say(c.amber("  Free mode ON \u2014 open conversation. You can ask for small custom changes. '/taskmode' to switch back."));
+      say();
+      continue;
+    }
+    if (bridged && (line === "/taskmode" || line === "/task")) {
+      freeMode = false;
+      say(c.green("  Task mode ON \u2014 precise actions."));
+      say();
+      continue;
+    }
     try {
       if (bridged) {
         const r = await runClaudeTurn({
           message: line,
           sessionId: claudeSession,
+          freeMode,
           write: (t) => process.stdout.write(t)
         });
         say();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sproutkit-code",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "description": "Sproutkit in your terminal — find leads, build sites, run outreach, all via chat.",
   "bin": {
     "sproutkit": "./dist/index.js"