sproutkit-code 1.7.0 → 1.8.0

package/dist/index.js

@@ -229,6 +229,12 @@ var require_db = __commonJS({
         // WITHOUT the client's password. Means handing the client full ownership
         // doesn't cost the agency its reporting.
         "report_key TEXT",
+        // `sproutkit audit` findings: how bad the business's EXISTING site is, and
+        // the specific problems to lead outreach with. Distinct from lead_kind's
+        // absence-based gaps.
+        "site_score INTEGER",
+        "site_issues TEXT",
+        "audited_at TEXT",
         // Reply loop: when we last contacted them, and the latest outcome. Kept on
         // the lead (as well as contact_log) so `followups` is a single cheap query.
         "last_contacted_at TEXT",
@@ -82790,6 +82796,389 @@ var require_booking_detect = __commonJS({
   }
 });
 
+// ../desktop/dist/main/lib/site-audit.js
+var require_site_audit = __commonJS({
+  "../desktop/dist/main/lib/site-audit.js"(exports2) {
+    "use strict";
+    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    }) : (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    }));
+    var __setModuleDefault = exports2 && exports2.__setModuleDefault || (Object.create ? (function(o, v) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v });
+    }) : function(o, v) {
+      o["default"] = v;
+    });
+    var __importStar = exports2 && exports2.__importStar || /* @__PURE__ */ (function() {
+      var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function(o2) {
+          var ar = [];
+          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
+          return ar;
+        };
+        return ownKeys(o);
+      };
+      return function(mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) {
+          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        }
+        __setModuleDefault(result, mod);
+        return result;
+      };
+    })();
+    var __importDefault = exports2 && exports2.__importDefault || function(mod) {
+      return mod && mod.__esModule ? mod : { "default": mod };
+    };
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.auditSite = auditSite;
+    exports2.isRebuildProspect = isRebuildProspect;
+    exports2.headlineIssues = headlineIssues;
+    var axios_1 = __importDefault(require_axios());
+    var tls = __importStar(require("tls"));
+    var url_1 = require("url");
+    var WEIGHT = {
+      critical: 30,
+      major: 15,
+      minor: 6
+    };
+    async function checkTls(hostname) {
+      return new Promise((resolve) => {
+        let settled = false;
+        const done = (r) => {
+          if (settled)
+            return;
+          settled = true;
+          socket.destroy();
+          resolve(r);
+        };
+        const socket = tls.connect({ host: hostname, port: 443, servername: hostname, timeout: 12e3 }, () => {
+          if (!socket.authorized) {
+            done({
+              ok: false,
+              issue: {
+                code: "tls_invalid",
+                label: "The security certificate isn\u2019t valid \u2014 browsers warn visitors before they can see the site",
+                severity: "critical",
+                detail: socket.authorizationError ? String(socket.authorizationError) : void 0
+              }
+            });
+            return;
+          }
+          const cert = socket.getPeerCertificate();
+          if (!cert || !cert.valid_to) {
+            done({ ok: true });
+            return;
+          }
+          const days = Math.round((new Date(cert.valid_to).getTime() - Date.now()) / 864e5);
+          if (days < 0) {
+            done({
+              ok: false,
+              daysToExpiry: days,
+              issue: {
+                code: "tls_expired",
+                label: "The security certificate has expired \u2014 visitors see a full-page warning",
+                severity: "critical",
+                detail: `expired ${Math.abs(days)} days ago`
+              }
+            });
+            return;
+          }
+          if (days <= 14) {
+            done({
+              ok: true,
+              daysToExpiry: days,
+              issue: {
+                code: "tls_expiring",
+                label: "The security certificate expires within two weeks",
+                severity: "major",
+                detail: `${days} days left`
+              }
+            });
+            return;
+          }
+          done({ ok: true, daysToExpiry: days });
+        });
+        socket.on("error", (err) => {
+          const msg = err.message || "";
+          const code = err.code ?? "";
+          let issue;
+          if (/certificate has expired|CERT_HAS_EXPIRED/i.test(msg + code)) {
+            issue = {
+              code: "tls_expired",
+              label: "The security certificate has expired \u2014 visitors see a full-page browser warning before they reach the site",
+              severity: "critical",
+              detail: msg
+            };
+          } else if (/self.signed|SELF_SIGNED/i.test(msg + code)) {
+            issue = {
+              code: "tls_self_signed",
+              label: "The security certificate isn\u2019t from a recognised authority, so browsers warn visitors away",
+              severity: "critical",
+              detail: msg
+            };
+          } else if (/altnames|hostname\/ip does not match|ERR_TLS_CERT_ALTNAME/i.test(msg + code)) {
+            issue = {
+              code: "tls_wrong_host",
+              label: "The security certificate was issued for a different domain, so browsers reject it",
+              severity: "critical",
+              detail: msg
+            };
+          } else if (/ECONNREFUSED|ENOTFOUND|EHOSTUNREACH|ECONNRESET/i.test(msg + code)) {
+            issue = {
+              code: "tls_unavailable",
+              label: "The site has no working HTTPS \u2014 Chrome labels it \u201CNot secure\u201D to every visitor",
+              severity: "critical",
+              detail: msg
+            };
+          } else {
+            issue = {
+              code: "tls_error",
+              label: "Secure connections to the site fail",
+              severity: "major",
+              detail: msg
+            };
+          }
+          done({ ok: false, issue });
+        });
+        socket.on("timeout", () => {
+          done({
+            ok: false,
+            issue: {
+              code: "tls_timeout",
+              label: "Secure connections to the site time out",
+              severity: "major"
+            }
+          });
+        });
+      });
+    }
+    function markupIssues(html, finalUrl) {
+      const issues = [];
+      const head = html.slice(0, 6e4);
+      if (!/<meta[^>]+name=["']?viewport/i.test(head)) {
+        issues.push({
+          code: "not_mobile",
+          label: "Not built for phones \u2014 the page loads zoomed out and has to be pinched to read",
+          severity: "critical"
+        });
+      }
+      const tableCount = (html.match(/<table/gi) ?? []).length;
+      if (tableCount >= 3 || /<table[^>]*>[\s\S]{0,400}<table/i.test(html)) {
+        issues.push({
+          code: "table_layout",
+          label: "Built with table layouts, a technique abandoned around 2010",
+          severity: "major",
+          detail: `${tableCount} tables`
+        });
+      }
+      if (/<(font|center|marquee|blink)\b/i.test(html)) {
+        const tag = html.match(/<(font|center|marquee|blink)\b/i)?.[1]?.toLowerCase();
+        issues.push({
+          code: "obsolete_tags",
+          label: `Uses HTML tags (<${tag}>) that have been removed from the web standard`,
+          severity: "major"
+        });
+      }
+      if (/\.swf\b|application\/x-shockwave-flash|<embed[^>]+flash/i.test(html)) {
+        issues.push({
+          code: "flash",
+          label: "Contains Flash content, which no browser has supported since 2020 \u2014 that part of the site is invisible",
+          severity: "critical"
+        });
+      }
+      const jq = html.match(/jquery[.-]?(\d+)\.(\d+)(?:\.(\d+))?(?:\.min)?\.js/i);
+      if (jq) {
+        const major = Number(jq[1]);
+        if (major < 3) {
+          issues.push({
+            code: "old_jquery",
+            label: "Runs a jQuery version with publicly known security vulnerabilities",
+            severity: "major",
+            detail: `jQuery ${jq[1]}.${jq[2]}${jq[3] ? "." + jq[3] : ""}`
+          });
+        }
+      }
+      const year = (/* @__PURE__ */ new Date()).getFullYear();
+      const years = [...html.matchAll(/(?:©|&copy;|copyright)\s*(?:\d{4}\s*[-–]\s*)?(\d{4})/gi)].map((m) => Number(m[1])).filter((y) => y >= 1995 && y <= year);
+      if (years.length) {
+        const newest = Math.max(...years);
+        const age = year - newest;
+        if (age >= 2) {
+          issues.push({
+            code: "stale_copyright",
+            label: `The footer still says ${newest} \u2014 visitors read that as \u201Cpossibly closed down\u201D`,
+            severity: age >= 5 ? "major" : "minor",
+            detail: `${age} years out of date`
+          });
+        }
+      }
+      if (/under construction|coming soon|website is being (?:built|updated)/i.test(head)) {
+        issues.push({
+          code: "under_construction",
+          label: "Still shows an \u201Cunder construction\u201D placeholder",
+          severity: "critical"
+        });
+      }
+      if (/this domain (?:is|may be) for sale|parked (?:free )?(?:at|by)|godaddy\.com\/domainfind|default web page/i.test(head)) {
+        issues.push({
+          code: "parked",
+          label: "The domain shows a parking page rather than a real website",
+          severity: "critical"
+        });
+      }
+      if (finalUrl.startsWith("https://")) {
+        const insecure = html.match(/(?:src|href)=["']http:\/\/(?!localhost)/gi);
+        if (insecure && insecure.length >= 2) {
+          issues.push({
+            code: "mixed_content",
+            label: "Loads images or scripts insecurely, so browsers block them and parts of the page break",
+            severity: "major",
+            detail: `${insecure.length} insecure references`
+          });
+        }
+      }
+      const title = html.match(/<title[^>]*>([\s\S]{0,200}?)<\/title>/i)?.[1]?.trim();
+      if (!title) {
+        issues.push({
+          code: "no_title",
+          label: "The page has no title, so search results show a bare web address",
+          severity: "major"
+        });
+      } else if (/^(home|untitled|new page \d*|document|index|website)$/i.test(title)) {
+        issues.push({
+          code: "default_title",
+          label: `The page title is still the template default (\u201C${title}\u201D), which is what Google shows`,
+          severity: "major"
+        });
+      }
+      if (!/<meta[^>]+name=["']?description/i.test(head)) {
+        issues.push({
+          code: "no_description",
+          label: "No search description, so Google invents one from whatever text it finds",
+          severity: "minor"
+        });
+      }
+      if (/<frameset|<frame\b/i.test(html)) {
+        issues.push({
+          code: "frames",
+          label: "Built with frames, which search engines cannot index properly",
+          severity: "critical"
+        });
+      }
+      return issues;
+    }
+    async function auditSite(websiteUrl) {
+      const raw = (websiteUrl ?? "").trim();
+      if (!raw)
+        return { url: raw, reachable: false, score: 0, issues: [], error: "No URL" };
+      const withScheme = /^https?:\/\//i.test(raw) ? raw : `https://${raw}`;
+      let hostname;
+      try {
+        hostname = new url_1.URL(withScheme).hostname;
+      } catch {
+        return { url: raw, reachable: false, score: 0, issues: [], error: "Unparseable URL" };
+      }
+      const issues = [];
+      const listedAsHttp = /^http:\/\//i.test(raw);
+      const [tlsResult, page] = await Promise.all([
+        checkTls(hostname).catch(() => ({ ok: true })),
+        fetchPage(withScheme)
+      ]);
+      if (tlsResult.issue)
+        issues.push(tlsResult.issue);
+      if (listedAsHttp && !tlsResult.issue) {
+        issues.push({
+          code: "listed_insecure",
+          label: "The address the business gives out starts with http:// \u2014 visitors following it get a \u201CNot secure\u201D warning",
+          severity: "major"
+        });
+      }
+      if (!page.ok) {
+        return {
+          url: raw,
+          reachable: false,
+          score: scoreOf(issues),
+          issues,
+          error: page.error
+        };
+      }
+      if (page.finalUrl.startsWith("http://") && !tlsResult.issue) {
+        issues.push({
+          code: "no_https_redirect",
+          label: "The site falls back to an unencrypted connection instead of staying secure",
+          severity: "major"
+        });
+      }
+      issues.push(...markupIssues(page.html, page.finalUrl));
+      const htmlKb = Math.round(page.html.length / 1024);
+      if (htmlKb > 600) {
+        issues.push({
+          code: "heavy_page",
+          label: "The page is unusually heavy, so it loads slowly on mobile data",
+          severity: "minor",
+          detail: `${htmlKb} KB of HTML`
+        });
+      }
+      return { url: raw, reachable: true, score: scoreOf(issues), issues, htmlKb };
+    }
+    async function fetchPage(url) {
+      try {
+        const res = await axios_1.default.get(url, {
+          timeout: 2e4,
+          maxRedirects: 5,
+          responseType: "text",
+          // Some hosts serve a stripped page to a bare client.
+          headers: {
+            "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120 Safari/537.36",
+            Accept: "text/html,application/xhtml+xml"
+          },
+          maxContentLength: 5e6,
+          validateStatus: () => true,
+          // We want to inspect a broken-cert site's markup too; the cert problem is
+          // reported separately by checkTls, so this doesn't hide anything.
+          httpsAgent: void 0
+        });
+        if (res.status >= 400) {
+          return { ok: false, error: `HTTP ${res.status}` };
+        }
+        const html = typeof res.data === "string" ? res.data : String(res.data ?? "");
+        if (!html)
+          return { ok: false, error: "Empty response" };
+        const finalUrl = res.request?.res?.responseUrl || url;
+        return { ok: true, html, finalUrl };
+      } catch (e) {
+        return { ok: false, error: e.message };
+      }
+    }
+    function scoreOf(issues) {
+      const total = issues.reduce((sum, i) => sum + WEIGHT[i.severity], 0);
+      return Math.min(100, total);
+    }
+    function isRebuildProspect(audit) {
+      if (!audit.issues.length)
+        return false;
+      const critical = audit.issues.filter((i) => i.severity === "critical").length;
+      const major = audit.issues.filter((i) => i.severity === "major").length;
+      return critical >= 1 || major >= 2;
+    }
+    function headlineIssues(audit, limit = 3) {
+      const rank = { critical: 0, major: 1, minor: 2 };
+      return [...audit.issues].sort((a, b) => rank[a.severity] - rank[b.severity]).slice(0, limit);
+    }
+  }
+});
+
 // ../desktop/dist/main/lib/lead-search.js
 var require_lead_search = __commonJS({
   "../desktop/dist/main/lib/lead-search.js"(exports2) {
@@ -82800,11 +83189,14 @@ var require_lead_search = __commonJS({
     var db_1 = require_db();
     var places_1 = require_places();
     var booking_detect_1 = require_booking_detect();
+    var site_audit_1 = require_site_audit();
     async function searchAndSaveLeadsStream(args, onLead) {
       const db2 = (0, db_1.getDb)();
       const cap = args.maxResults ?? 50;
       const seen = /* @__PURE__ */ new Set();
       const bookingMode = args.mode === "no_booking";
+      const auditMode = args.mode === "outdated";
+      const wantsSiteHavers = bookingMode || auditMode;
       let saved = 0;
       let found = 0;
       await (0, places_1.searchPlacesStream)({
@@ -82813,8 +83205,8 @@ var require_lead_search = __commonJS({
         types: args.types,
         center: args.center,
         radiusMeters: args.radiusMeters,
-        // Booking mode needs the businesses that DO have a website.
-        includeWithWebsite: bookingMode
+        // Booking and audit modes need the businesses that DO have a website.
+        includeWithWebsite: wantsSiteHavers
       }, async (batch) => {
         for (const r of batch) {
           found++;
@@ -82829,7 +83221,19 @@ var require_lead_search = __commonJS({
           let leadKind = "no_website";
           let bookingStatus = null;
           let bookingPlatform = null;
-          if (bookingMode) {
+          let siteScore = null;
+          let siteIssues = null;
+          if (auditMode) {
+            if (!r.website)
+              continue;
+            args.onProgress?.(`Auditing ${r.name}'s website\u2026`);
+            const audit = await (0, site_audit_1.auditSite)(r.website);
+            if (!(0, site_audit_1.isRebuildProspect)(audit))
+              continue;
+            siteScore = audit.score;
+            siteIssues = JSON.stringify(audit.issues);
+            leadKind = "outdated";
+          } else if (bookingMode) {
             if (!r.website)
               continue;
             args.onProgress?.(`Checking ${r.name}'s booking setup\u2026`);
@@ -82843,8 +83247,8 @@ var require_lead_search = __commonJS({
             continue;
           }
           db2.run(`INSERT INTO leads
-            (place_id, name, type, city, address, phone, website, rating, review_count, lat, lng, score, price_level, business_status, status, lead_kind, booking_status, booking_platform)
-           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'discovered', ?, ?, ?)`, [
+            (place_id, name, type, city, address, phone, website, rating, review_count, lat, lng, score, price_level, business_status, status, lead_kind, booking_status, booking_platform, site_score, site_issues, audited_at)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'discovered', ?, ?, ?, ?, ?, ?)`, [
             r.place_id,
             r.name,
             r.type,
@@ -82861,7 +83265,10 @@ var require_lead_search = __commonJS({
             r.business_status,
             leadKind,
             bookingStatus,
-            bookingPlatform
+            bookingPlatform,
+            siteScore,
+            siteIssues,
+            siteScore === null ? null : (/* @__PURE__ */ new Date()).toISOString()
           ]);
           const row = db2.get("SELECT id FROM leads WHERE place_id = ?", [r.place_id]);
           saved++;
@@ -95258,6 +95665,7 @@ var require_chat_tools = __commonJS({
     var lead_search_1 = require_lead_search();
     var places_1 = require_places();
     var booking_detect_1 = require_booking_detect();
+    var site_audit_1 = require_site_audit();
     var followup_1 = require_followup();
     var invoicing_1 = require_invoicing();
     var agency_1 = require_agency();
@@ -95449,6 +95857,44 @@ var require_chat_tools = __commonJS({
           required: ["id"]
         }
       },
+      {
+        name: "audit_sites",
+        description: "AUDIT existing websites in an area and save the bad ones as rebuild prospects. Unlike find_leads (which looks for businesses with NO website), this finds businesses that DO have a website and checks it for real, nameable faults: expired or missing HTTPS certificates, no mobile support, table layouts, Flash, obsolete jQuery, parked or under-construction pages, stale copyright years. Each prospect is scored (higher = worse) and its specific problems are stored so outreach can cite them. Use this when the user wants to find outdated, insecure or badly built websites to pitch a rebuild against. Costs the same Places lookup as find_leads plus one fetch per site.",
+        input_schema: {
+          type: "object",
+          properties: {
+            location: {
+              type: "string",
+              description: "Town, postcode, area or address to search, e.g. 'Leeds LS1' or 'Shoreditch, London'."
+            },
+            categories: {
+              type: "array",
+              items: { type: "string" },
+              description: "Business types to search, e.g. ['barber shop','cafe','plumber']."
+            },
+            radiusMeters: {
+              type: "number",
+              description: "Search radius in metres. Defaults to 10000."
+            },
+            limit: {
+              type: "number",
+              description: "Maximum prospects to save. Defaults to 25."
+            }
+          },
+          required: ["location", "categories"]
+        }
+      },
+      {
+        name: "audit_one_site",
+        description: "Audit a SINGLE website by URL and report its faults, without saving anything. Use this when the user names a specific site and asks what's wrong with it, or to check a business's site before pitching them.",
+        input_schema: {
+          type: "object",
+          properties: {
+            url: { type: "string", description: "The website to audit, e.g. 'thebarbers.co.uk'." },
+            id: { type: "number", description: "Or a lead id \u2014 audits that lead's website and stores the result." }
+          }
+        }
+      },
       {
         name: "hand_over_site",
         description: "HAND OVER a finished site to the paying client: removes the DEMO/preview banner, optionally attaches the client's own domain, and returns every credential in one place (site URL, /admin panel + password, booking page + its password, and the DNS records the client must set at their registrar). This is the paid-deliverable step \u2014 the banner exists to stop clients using a free demo as their real site, so only run this when the user says the client has paid / signed off / is going live. Requires the lead to already have a built site or booking page.",
@@ -96241,6 +96687,77 @@ Interested?`;
             return { ok: false, error: stats.error, business: lead.name };
           return { ok: true, id, business: lead.name, url: base, ...stats.data };
         }
+        case "audit_sites": {
+          const location = String(input.location ?? "").trim();
+          const categories = input.categories ?? [];
+          if (!location || categories.length === 0) {
+            return { ok: false, error: "Give me a location and at least one business category." };
+          }
+          const placesKey = getDecryptedSetting("places_key");
+          if (!placesKey)
+            throw new Error("Google Places API key not set in Settings");
+          ctx.emitProgress?.({
+            channel: "leads:searching",
+            payload: { msg: `Auditing websites in ${location}\u2026` }
+          });
+          const matches = await (0, places_1.geocodeForward)(location, 1);
+          const place = matches[0];
+          const result = await (0, lead_search_1.searchAndSaveLeadsStream)({
+            placesKey,
+            city: location,
+            types: categories,
+            maxResults: Math.min(Number(input.limit ?? 25), 100),
+            center: place ? { lat: place.lat, lng: place.lng } : void 0,
+            radiusMeters: Number(input.radiusMeters ?? 1e4),
+            mode: "outdated"
+          }, (lead) => ctx.emitProgress?.({ channel: "leads:found", payload: { lead } }));
+          ctx.emitProgress?.({ channel: "leads:changed", payload: { reason: "audit_sites" } });
+          const saved = db2.all(`SELECT id, name, website, site_score, site_issues
+         FROM leads
+         WHERE lead_kind = 'outdated' AND audited_at IS NOT NULL
+         ORDER BY audited_at DESC, site_score DESC
+         LIMIT ?`, [Number(input.limit ?? 25)]);
+          return {
+            ok: true,
+            found: result.found,
+            saved: result.saved,
+            prospects: saved.map((r) => ({
+              id: r.id,
+              business: r.name,
+              website: r.website,
+              score: r.site_score,
+              issues: JSON.parse(r.site_issues || "[]").slice(0, 3).map((i) => `${i.severity}: ${i.label}`)
+            }))
+          };
+        }
+        case "audit_one_site": {
+          let url = input.url ?? "";
+          let leadId = null;
+          if (input.id != null) {
+            leadId = Number(input.id);
+            const lead = db2.get("SELECT id, name, website FROM leads WHERE id = ?", [leadId]);
+            if (!lead)
+              throw new Error(`Lead #${leadId} not found`);
+            if (!lead.website)
+              return { ok: false, error: `#${leadId} ${lead.name} has no website on record.` };
+            url = lead.website;
+          }
+          if (!url)
+            return { ok: false, error: "Give me a website URL or a lead id." };
+          const audit = await (0, site_audit_1.auditSite)(url);
+          if (leadId !== null) {
+            db2.run("UPDATE leads SET site_score = ?, site_issues = ?, audited_at = ? WHERE id = ?", [audit.score, JSON.stringify(audit.issues), (/* @__PURE__ */ new Date()).toISOString(), leadId]);
+          }
+          return {
+            ok: true,
+            url: audit.url,
+            reachable: audit.reachable,
+            score: audit.score,
+            worthRebuilding: (0, site_audit_1.isRebuildProspect)(audit),
+            issues: audit.issues,
+            error: audit.error
+          };
+        }
         case "hand_over_site": {
           const id = Number(input.id);
           const lead = db2.get("SELECT id, name, site_url, booking_url FROM leads WHERE id = ?", [id]);
@@ -97274,7 +97791,7 @@ var require_package2 = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "sproutkit-code",
-      version: "1.7.0",
+      version: "1.8.0",
       description: "Sproutkit in your terminal \u2014 find leads, build sites, run outreach, all via chat.",
       bin: {
         sproutkit: "./dist/index.js"
@@ -99146,6 +99663,135 @@ async function cmdReport(argv) {
     process.exitCode = 1;
   }
 }
+async function cmdAudit(argv) {
+  const { flags, rest } = parseArgs(argv);
+  const json = !!flags.json;
+  const SEV_COLOUR = {
+    critical: c.red,
+    major: c.amber,
+    minor: c.dim
+  };
+  const asId = Number(flags.id ?? rest[0]);
+  const singleUrl = flags.url ? String(flags.url) : void 0;
+  const looksLikeUrl = singleUrl || rest[0] && /\./.test(String(rest[0])) && !flags.categories;
+  if (singleUrl || !Number.isNaN(asId) && rest.length === 1 && !flags.categories || looksLikeUrl) {
+    const status2 = json ? void 0 : new Status();
+    const target = singleUrl ?? (Number.isNaN(asId) ? String(rest[0]) : `lead #${asId}`);
+    if (status2) status2.start(`Auditing ${target}`);
+    try {
+      const r = await runTool(
+        "audit_one_site",
+        Number.isNaN(asId) || singleUrl ? { url: singleUrl ?? String(rest[0]) } : { id: asId },
+        makeCtx({ json, status: status2 })
+      );
+      if (r && r.ok === false) {
+        if (status2) status2.done(false, r.error ?? "Couldn't audit it");
+        if (json) emitJson(r);
+        process.exitCode = 1;
+        return;
+      }
+      if (status2) {
+        status2.done(
+          true,
+          r.issues && r.issues.length ? `${r.issues.length} issue${r.issues.length === 1 ? "" : "s"} \xB7 score ${r.score}` : "No problems found"
+        );
+      }
+      if (json) {
+        emitJson(r);
+        return;
+      }
+      say();
+      say(`  ${c.bold(String(r.url))}` + c.dim(`  \xB7  score ${r.score}/100`));
+      if (!r.issues?.length) {
+        say(c.dim("  Nothing worth pitching against \u2014 this site is in decent shape."));
+        say();
+        return;
+      }
+      say();
+      for (const i of r.issues) {
+        const tint = SEV_COLOUR[i.severity] ?? c.dim;
+        say(`  ${tint("\u25CF")} ${i.label}${i.detail ? c.dim(`  (${i.detail})`) : ""}`);
+      }
+      say();
+      say(
+        r.worthRebuilding ? c.green("  Worth approaching \u2014 these are concrete problems you can name.") : c.dim("  Minor only. Probably not worth a rebuild pitch.")
+      );
+      say();
+    } catch (e) {
+      if (status2) status2.done(false, "Audit failed");
+      json ? emitJson({ ok: false, error: e.message }) : say(c.red("  " + e.message));
+      process.exitCode = 1;
+    }
+    return;
+  }
+  const location = rest.join(" ").trim() || (flags.location ? String(flags.location) : "");
+  if (!location) {
+    const err = 'Usage: sproutkit audit "<area>" --categories "barber shop,cafe"\n         single site: sproutkit audit <leadId>  \xB7  sproutkit audit --url thebarbers.co.uk';
+    json ? emitJson({ ok: false, error: err }) : say(c.red("  " + err));
+    process.exitCode = 1;
+    return;
+  }
+  const categories = flags.categories ? String(flags.categories).split(",").map((t) => t.trim()).filter(Boolean) : [];
+  if (categories.length === 0) {
+    const err = 'Which trades? e.g. --categories "barber shop,cafe,plumber"';
+    json ? emitJson({ ok: false, error: err }) : say(c.red("  " + err));
+    process.exitCode = 1;
+    return;
+  }
+  const status = json ? void 0 : new Status();
+  if (status) status.start(`Auditing websites in ${location}`);
+  try {
+    const r = await runTool(
+      "audit_sites",
+      {
+        location,
+        categories,
+        radiusMeters: flags.radius ? Number(flags.radius) : void 0,
+        limit: flags.limit ? Number(flags.limit) : void 0
+      },
+      makeCtx({ json, status })
+    );
+    if (r && r.ok === false) {
+      if (status) status.done(false, r.error ?? "Audit failed");
+      if (json) emitJson(r);
+      process.exitCode = 1;
+      return;
+    }
+    if (status) status.done(true, `${r.saved} rebuild prospect${r.saved === 1 ? "" : "s"} from ${r.found} checked`);
+    autoSync();
+    if (json) {
+      emitJson(r);
+      return;
+    }
+    const list = r.prospects ?? [];
+    if (!list.length) {
+      say();
+      say(c.dim(`  Checked ${r.found} businesses \u2014 none had a site bad enough to pitch against.`));
+      say(c.dim("  That's a good sign for the area; try a different trade or a wider radius."));
+      say();
+      return;
+    }
+    say();
+    say(c.dim("  Worst first \u2014 these are the easiest conversations to start."));
+    say();
+    for (const p of list) {
+      say(`  ${c.greenBold("#" + p.id)} ${c.bold(p.business)}  ${c.dim(p.website.replace(/^https?:\/\//, ""))}`);
+      say(`      ${c.amber("score " + p.score + "/100")}`);
+      for (const issue of p.issues) {
+        const [sev, ...restText] = issue.split(": ");
+        const tint = SEV_COLOUR[sev] ?? c.dim;
+        say(`      ${tint("\u25CF")} ${restText.join(": ")}`);
+      }
+      say();
+    }
+    say(c.dim("  Build one: sproutkit build <id>   \xB7   see everything: sproutkit audit <id>"));
+    say();
+  } catch (e) {
+    if (status) status.done(false, "Audit failed");
+    json ? emitJson({ ok: false, error: e.message }) : say(c.red("  " + e.message));
+    process.exitCode = 1;
+  }
+}
 async function cmdRegenerate(argv) {
   const { flags, rest } = parseArgs(argv);
   const json = !!flags.json;
@@ -99408,6 +100054,8 @@ When a request is missing information the command needs, ask a SHORT, STRUCTURED
 COMMANDS:
 - sproutkit find "<area>" --categories "<type>,<type>" --json   \u2014 find website-less leads
 - sproutkit find "<area>" --categories "\u2026" --booking --json     \u2014 find businesses that HAVE a site but take bookings via WhatsApp/phone only (booking-page prospects)
+- sproutkit audit "<area>" --categories "\u2026" --json              \u2014 find businesses whose EXISTING site is insecure/outdated
+- sproutkit audit <id> | --url <site> --json                    \u2014 audit one site, list its faults
 - sproutkit list [--status <s>] [--city <c>] [--limit 100]      \u2014 formatted table; SHOW IT VERBATIM
 - sproutkit list --json                                         \u2014 same data as JSON, for reading ids only
 - sproutkit build <id> --json [--instructions "..."] [--cms] [--multipage]  \u2014 build a demo site (--multipage = real Home/Services/About/Contact pages, not one scroll)
@@ -99607,7 +100255,7 @@ async function main() {
     closeTty();
     return;
   }
-  if (arg === "find" || arg === "list" || arg === "build" || arg === "build-all" || arg === "regenerate" || arg === "cms" || arg === "book" || arg === "handover" || arg === "brand" || arg === "invoice" || arg === "letter" || arg === "reply" || arg === "followups" || arg === "report" || arg === "outreach" || arg === "pipeline") {
+  if (arg === "find" || arg === "list" || arg === "build" || arg === "build-all" || arg === "regenerate" || arg === "cms" || arg === "book" || arg === "handover" || arg === "audit" || arg === "brand" || arg === "invoice" || arg === "letter" || arg === "reply" || arg === "followups" || arg === "report" || arg === "outreach" || arg === "pipeline") {
     const subArgs = process.argv.slice(3);
     if (subArgs.includes("--help") || subArgs.includes("-h")) {
       const USAGE = {
@@ -99647,6 +100295,16 @@ async function main() {
           '  --instructions "\u2026"   e.g. "45-min slots, add beard trim \xA312"',
           "  --email <addr>       owner email for booking notifications"
         ],
+        audit: [
+          'sproutkit audit "<area>" --categories "barber shop,cafe"',
+          "  finds businesses that HAVE a website but whose site is costing them",
+          "  work \u2014 no HTTPS, unusable on phones, built in 2008 \u2014 and scores it",
+          "  --radius <m>         search radius (default 10000)",
+          "  --limit <n>          max prospects to save (default 25)",
+          "",
+          "  one site: sproutkit audit <leadId>",
+          "            sproutkit audit --url thebarbers.co.uk"
+        ],
         brand: [
           'sproutkit brand --name "Your Studio" --email you@x.com [--vat-rate 20]',
           "  your agency identity \u2014 goes on invoices, letters, the site footer",
@@ -99724,6 +100382,7 @@ async function main() {
     else if (arg === "cms") await cmdCms(subArgs);
     else if (arg === "book") await cmdBook(subArgs);
     else if (arg === "handover") await cmdHandover(subArgs);
+    else if (arg === "audit") await cmdAudit(subArgs);
     else if (arg === "brand") await cmdBrand(subArgs);
     else if (arg === "invoice") await cmdInvoice(subArgs);
     else if (arg === "letter") await cmdLetter(subArgs);

package/dist/skill/SKILL.md

@@ -93,6 +93,17 @@ you can parse results reliably, then summarise them for the user in prose.
   - The banner exists to stop clients using a free demo as their real site, so
     do NOT run this just because a site looks finished.
 
+- **Audit existing websites** — `sproutkit audit "<area>" --categories "barber shop,cafe" --json`
+  - The counterpart to `find`. Where `find` looks for the ABSENCE of a website,
+    `audit` looks at sites that DO exist and finds the ones costing their owner
+    work: expired or missing HTTPS, no mobile support, table layouts, Flash,
+    obsolete jQuery, parked/under-construction pages, stale copyright years.
+  - Each prospect is scored (higher = worse) and its specific faults are stored,
+    so outreach can name real problems rather than say "your site looks dated".
+  - Single site: `sproutkit audit <leadId>` or `sproutkit audit --url thebarbers.co.uk`.
+  - Sites with only minor issues are deliberately skipped — pitching a rebuild
+    over a missing meta description makes the agency look desperate.
+
 - **Set up the agency's identity** — `sproutkit brand --show`
   - Their name, logo, address, VAT and bank details. This is what appears on
     invoices and letters, in the site footer credit, on the demo banner and in

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sproutkit-code",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "description": "Sproutkit in your terminal — find leads, build sites, run outreach, all via chat.",
   "bin": {
     "sproutkit": "./dist/index.js"