sproutkit-code 1.9.1 → 1.10.0

package/dist/index.js

@@ -96,7 +96,8 @@ var require_runtime = __commonJS({
       "resend_key",
       "report_key",
       "smtp_pass",
-      "imap_pass"
+      "imap_pass",
+      "stripe_secret_key"
     ]);
     function isSecretSetting(key) {
       return SECRET_SETTINGS.has(key);
@@ -314,6 +315,84 @@ var require_db = __commonJS({
       last_result TEXT,
       created_at TEXT DEFAULT (datetime('now'))
     );
+  `);
+      try {
+        db2.exec("ALTER TABLE schedules ADD COLUMN config TEXT");
+      } catch {
+      }
+      db2.exec(`
+    CREATE TABLE IF NOT EXISTS messages (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      lead_id INTEGER NOT NULL,
+      direction TEXT NOT NULL,
+      from_addr TEXT,
+      to_addr TEXT,
+      subject TEXT,
+      body TEXT,
+      message_id TEXT UNIQUE,
+      in_reply_to TEXT,
+      at TEXT NOT NULL DEFAULT (datetime('now')),
+      intent TEXT,
+      intent_summary TEXT,
+      confidence REAL,
+      handled TEXT NOT NULL DEFAULT 'new',
+      draft_subject TEXT,
+      draft_body TEXT,
+      sent_by TEXT
+    );
+  `);
+      try {
+        db2.exec("CREATE INDEX IF NOT EXISTS idx_messages_lead ON messages(lead_id, at)");
+      } catch {
+      }
+      try {
+        db2.exec(`
+      INSERT INTO messages (lead_id, direction, from_addr, body, at, handled)
+      SELECT id, 'in', email, last_reply_snippet, COALESCE(last_reply_at, replied_at, datetime('now')), 'done'
+        FROM leads
+       WHERE last_reply_snippet IS NOT NULL AND last_reply_snippet != ''
+         AND NOT EXISTS (SELECT 1 FROM messages m WHERE m.lead_id = leads.id)
+    `);
+      } catch {
+      }
+      db2.exec(`
+    CREATE TABLE IF NOT EXISTS do_not_contact (
+      email TEXT PRIMARY KEY,
+      lead_id INTEGER,
+      reason TEXT,
+      at TEXT NOT NULL DEFAULT (datetime('now'))
+    );
+  `);
+      db2.exec(`
+    CREATE TABLE IF NOT EXISTS activity_log (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      at TEXT NOT NULL DEFAULT (datetime('now')),
+      actor TEXT NOT NULL,
+      action TEXT NOT NULL,
+      lead_id INTEGER,
+      detail TEXT,
+      needs_you INTEGER NOT NULL DEFAULT 0
+    );
+  `);
+      db2.exec(`
+    CREATE TABLE IF NOT EXISTS deals (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      lead_id INTEGER NOT NULL,
+      status TEXT NOT NULL DEFAULT 'open',
+      site_pence INTEGER NOT NULL,
+      care_pence INTEGER NOT NULL DEFAULT 0,
+      currency TEXT NOT NULL,
+      payment_link_id TEXT,
+      payment_url TEXT,
+      checkout_session_id TEXT,
+      stripe_customer_id TEXT,
+      subscription_id TEXT,
+      care_status TEXT,
+      invoice_number TEXT,
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      paid_at TEXT,
+      handed_over_at TEXT
+    );
   `);
     }
     function getDb2() {
@@ -30587,12 +30666,31 @@ var require_llm = __commonJS({
         backend: "api"
       };
     }
+    var STALE_MODEL = /issue with the selected model|model .*(does not exist|not found|may not exist)|invalid model/i;
+    var FALLBACK_ALIASES = ["sonnet", "opus", "haiku"];
     async function generateViaClaudeCode(args) {
+      const preferred = getClaudeCodeModel2();
+      try {
+        return await runClaudeCode(args, preferred);
+      } catch (e) {
+        if (!STALE_MODEL.test(e.message))
+          throw e;
+        for (const alias of FALLBACK_ALIASES.filter((a) => a !== preferred)) {
+          try {
+            return await runClaudeCode(args, alias);
+          } catch (e2) {
+            if (!STALE_MODEL.test(e2.message))
+              throw e2;
+          }
+        }
+        throw e;
+      }
+    }
+    async function runClaudeCode(args, alias) {
       if (args.images && args.images.length > 0) {
         throw new Error("Image input isn't supported on the Claude subscription backend. This step needs an Anthropic API key.");
       }
       const cliArgs = ["-p", "--output-format", "json"];
-      const alias = getClaudeCodeModel2();
       if (alias)
         cliArgs.push("--model", alias);
       if (args.allowWebSearch)
@@ -95611,7 +95709,9 @@ var require_email = __commonJS({
           from: cfg.from,
           to: args.to,
           subject: args.subject,
-          text: args.text
+          text: args.text,
+          ...args.inReplyTo ? { inReplyTo: args.inReplyTo } : {},
+          ...args.references ? { references: args.references } : {}
         });
         return { ok: true, messageId: info.messageId };
       } catch (e) {
@@ -95706,6 +95806,487 @@ Respond with ONLY compact JSON, no prose: {"email": string|null}`;
   }
 });
 
+// ../desktop/dist/main/lib/guardrails.js
+var require_guardrails = __commonJS({
+  "../desktop/dist/main/lib/guardrails.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.getAutopilotSettings = getAutopilotSettings;
+    exports2.setAutopilotSettings = setAutopilotSettings;
+    exports2.emailsSentToday = emailsSentToday;
+    exports2.sendBlockedReason = sendBlockedReason;
+    exports2.isSuppressed = isSuppressed;
+    exports2.suppress = suppress;
+    exports2.unsuppress = unsuppress;
+    exports2.listSuppressed = listSuppressed;
+    exports2.logActivity = logActivity;
+    exports2.listActivity = listActivity;
+    exports2.clearNeedsYou = clearNeedsYou;
+    var db_1 = require_db();
+    var DEFAULTS = {
+      paused: false,
+      replyMode: "draft",
+      sendProposals: true,
+      handoverMode: "ask",
+      maxEmailsPerDay: 30,
+      minConfidence: 0.8,
+      sitePence: 19900,
+      carePence: 0,
+      callUrl: null
+    };
+    function read(key) {
+      const row = (0, db_1.getDb)().get("SELECT value FROM settings WHERE key = ?", [key]);
+      return row?.value ?? null;
+    }
+    function write(key, value) {
+      (0, db_1.getDb)().run("INSERT INTO settings (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value", [key, value]);
+    }
+    var num = (v, d) => v != null && v !== "" && !Number.isNaN(Number(v)) ? Number(v) : d;
+    function getAutopilotSettings() {
+      const mode = read("auto_reply_mode");
+      return {
+        paused: read("autopilot_paused") === "1",
+        replyMode: mode === "off" || mode === "auto" || mode === "draft" ? mode : DEFAULTS.replyMode,
+        sendProposals: read("auto_send_proposals") !== "0",
+        handoverMode: read("auto_handover_mode") === "auto" ? "auto" : "ask",
+        maxEmailsPerDay: num(read("cap_emails_per_day"), DEFAULTS.maxEmailsPerDay),
+        minConfidence: num(read("auto_min_confidence"), DEFAULTS.minConfidence),
+        sitePence: num(read("price_site_pence"), DEFAULTS.sitePence),
+        carePence: num(read("price_care_pence"), DEFAULTS.carePence),
+        callUrl: read("call_booking_url") || null
+      };
+    }
+    function setAutopilotSettings(patch) {
+      if (patch.paused !== void 0)
+        write("autopilot_paused", patch.paused ? "1" : "0");
+      if (patch.replyMode)
+        write("auto_reply_mode", patch.replyMode);
+      if (patch.sendProposals !== void 0)
+        write("auto_send_proposals", patch.sendProposals ? "1" : "0");
+      if (patch.handoverMode)
+        write("auto_handover_mode", patch.handoverMode);
+      if (patch.maxEmailsPerDay !== void 0)
+        write("cap_emails_per_day", String(Math.max(0, Math.floor(patch.maxEmailsPerDay))));
+      if (patch.minConfidence !== void 0)
+        write("auto_min_confidence", String(Math.min(1, Math.max(0.5, patch.minConfidence))));
+      if (patch.sitePence !== void 0)
+        write("price_site_pence", String(Math.max(0, Math.round(patch.sitePence))));
+      if (patch.carePence !== void 0)
+        write("price_care_pence", String(Math.max(0, Math.round(patch.carePence))));
+      if (patch.callUrl !== void 0)
+        write("call_booking_url", patch.callUrl ?? "");
+      return getAutopilotSettings();
+    }
+    function emailsSentToday() {
+      const row = (0, db_1.getDb)().get(`SELECT COUNT(*) AS n FROM messages
+      WHERE direction = 'out' AND date(at) = date('now')`, []);
+      return row?.n ?? 0;
+    }
+    function sendBlockedReason() {
+      const s = getAutopilotSettings();
+      if (s.paused)
+        return "Autopilot is paused.";
+      const sent = emailsSentToday();
+      if (sent >= s.maxEmailsPerDay)
+        return `Daily email limit reached (${sent}/${s.maxEmailsPerDay}).`;
+      return null;
+    }
+    var norm = (e) => e.trim().toLowerCase();
+    function isSuppressed(email) {
+      if (!email)
+        return false;
+      return !!(0, db_1.getDb)().get("SELECT 1 FROM do_not_contact WHERE email = ?", [norm(email)]);
+    }
+    function suppress(email, reason, leadId) {
+      (0, db_1.getDb)().run(`INSERT INTO do_not_contact (email, lead_id, reason) VALUES (?, ?, ?)
+     ON CONFLICT(email) DO UPDATE SET reason = excluded.reason`, [norm(email), leadId ?? null, reason]);
+    }
+    function unsuppress(email) {
+      (0, db_1.getDb)().run("DELETE FROM do_not_contact WHERE email = ?", [norm(email)]);
+    }
+    function listSuppressed() {
+      return (0, db_1.getDb)().all("SELECT email, lead_id, reason, at FROM do_not_contact ORDER BY at DESC", []);
+    }
+    function logActivity(args) {
+      (0, db_1.getDb)().run("INSERT INTO activity_log (actor, action, lead_id, detail, needs_you) VALUES (?, ?, ?, ?, ?)", [args.actor ?? "autopilot", args.action, args.leadId ?? null, args.detail ?? null, args.needsYou ? 1 : 0]);
+    }
+    function listActivity(limit = 100) {
+      return (0, db_1.getDb)().all(`SELECT a.*, l.name AS lead_name FROM activity_log a
+       LEFT JOIN leads l ON l.id = a.lead_id
+      ORDER BY a.id DESC LIMIT ?`, [limit]);
+    }
+    function clearNeedsYou(id) {
+      (0, db_1.getDb)().run("UPDATE activity_log SET needs_you = 0 WHERE id = ?", [id]);
+    }
+  }
+});
+
+// ../desktop/dist/main/lib/inbox.js
+var require_inbox = __commonJS({
+  "../desktop/dist/main/lib/inbox.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.recordOutgoing = recordOutgoing;
+    exports2.recordIncoming = recordIncoming;
+    exports2.listThreads = listThreads;
+    exports2.getThread = getThread;
+    exports2.extractReplyText = extractReplyText;
+    exports2.runReplyAgent = runReplyAgent;
+    exports2.sendDraft = sendDraft;
+    exports2.dismissMessage = dismissMessage;
+    exports2.resetForAgent = resetForAgent;
+    exports2.sendFollowUps = sendFollowUps;
+    var db_1 = require_db();
+    var email_1 = require_email();
+    var llm_1 = require_llm();
+    var followup_1 = require_followup();
+    var agency_1 = require_agency();
+    var guardrails_1 = require_guardrails();
+    var AUTO_SENDABLE = ["interested", "price_question", "question"];
+    function recordOutgoing(args) {
+      (0, db_1.getDb)().run(`INSERT OR IGNORE INTO messages
+       (lead_id, direction, from_addr, to_addr, subject, body, message_id, in_reply_to, handled, sent_by)
+     VALUES (?, 'out', ?, ?, ?, ?, ?, ?, 'done', ?)`, [args.leadId, args.from ?? null, args.to, args.subject, args.body, args.messageId ?? null, args.inReplyTo ?? null, args.sentBy]);
+      if (args.messageId) {
+        (0, db_1.getDb)().run("UPDATE leads SET last_email_message_id = ? WHERE id = ?", [args.messageId, args.leadId]);
+      }
+    }
+    function recordIncoming(args) {
+      const db2 = (0, db_1.getDb)();
+      if (args.messageId && db2.get("SELECT 1 FROM messages WHERE message_id = ?", [args.messageId]))
+        return false;
+      db2.run(`INSERT INTO messages (lead_id, direction, from_addr, subject, body, message_id, in_reply_to, at)
+     VALUES (?, 'in', ?, ?, ?, ?, ?, ?)`, [
+        args.leadId,
+        args.from,
+        args.subject,
+        args.body,
+        args.messageId,
+        args.inReplyTo,
+        (args.at ?? /* @__PURE__ */ new Date()).toISOString()
+      ]);
+      return true;
+    }
+    function listThreads() {
+      const rows = (0, db_1.getDb)().all(`SELECT l.id AS lead_id, l.name, l.email, l.status, l.site_url,
+            m.at AS last_at, m.direction AS last_direction, substr(m.body, 1, 160) AS last_preview,
+            (SELECT COUNT(*) FROM messages p WHERE p.lead_id = l.id AND p.direction = 'in'
+               AND p.handled IN ('new','drafted','needs_you')) AS pending,
+            (SELECT intent FROM messages q WHERE q.lead_id = l.id AND q.direction = 'in'
+               AND q.intent IS NOT NULL ORDER BY q.at DESC LIMIT 1) AS latest_intent
+       FROM leads l
+       JOIN messages m ON m.id = (SELECT id FROM messages WHERE lead_id = l.id ORDER BY at DESC, id DESC LIMIT 1)
+      ORDER BY pending > 0 DESC, m.at DESC`, []);
+      return rows.map((r) => ({ ...r, suppressed: (0, guardrails_1.isSuppressed)(r.email) }));
+    }
+    function getThread(leadId) {
+      return (0, db_1.getDb)().all("SELECT * FROM messages WHERE lead_id = ? ORDER BY at ASC, id ASC", [leadId]);
+    }
+    function splitHead(raw) {
+      const m = raw.match(/\r?\n\r?\n/);
+      if (!m || m.index === void 0)
+        return [raw, ""];
+      return [raw.slice(0, m.index), raw.slice(m.index + m[0].length)];
+    }
+    function header(head, name) {
+      const unfolded = head.replace(/\r?\n[ \t]+/g, " ");
+      const line = unfolded.split(/\r?\n/).find((l) => l.toLowerCase().startsWith(name.toLowerCase() + ":"));
+      return line ? line.slice(line.indexOf(":") + 1).trim() : "";
+    }
+    function decodeBody(body, encoding) {
+      const enc = encoding.toLowerCase();
+      if (enc === "base64") {
+        try {
+          return Buffer.from(body.replace(/\s+/g, ""), "base64").toString("utf-8");
+        } catch {
+          return body;
+        }
+      }
+      if (enc === "quoted-printable") {
+        const bytes = body.replace(/=\r?\n/g, "").replace(/=([0-9A-F]{2})/gi, (_, h) => String.fromCharCode(parseInt(h, 16)));
+        return Buffer.from(bytes, "latin1").toString("utf-8");
+      }
+      return body;
+    }
+    function htmlToText(html) {
+      return html.replace(/<(style|script)[\s\S]*?<\/\1>/gi, "").replace(/<br\s*\/?>/gi, "\n").replace(/<\/(p|div|li|tr|h\d)>/gi, "\n").replace(/<[^>]+>/g, "").replace(/&nbsp;/g, " ").replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&#39;|&apos;/g, "'").replace(/&quot;/g, '"');
+    }
+    function partText(raw, depth = 0) {
+      const [head, body] = splitHead(raw);
+      const type = header(head, "content-type").toLowerCase();
+      const enc = header(head, "content-transfer-encoding");
+      if (type.startsWith("multipart/") && depth < 5) {
+        const b = header(head, "content-type").match(/boundary="?([^";]+)"?/i)?.[1];
+        if (!b)
+          return { plain: body };
+        const out = {};
+        for (const part of body.split(`--${b}`).slice(1)) {
+          if (part.startsWith("--"))
+            break;
+          const r = partText(part.replace(/^\r?\n/, ""), depth + 1);
+          out.plain ??= r.plain;
+          out.html ??= r.html;
+        }
+        return out;
+      }
+      if (type.includes("text/html"))
+        return { html: decodeBody(body, enc) };
+      if (!type || type.includes("text/plain"))
+        return { plain: decodeBody(body, enc) };
+      return {};
+    }
+    function extractReplyText(raw) {
+      const parts = partText(raw);
+      const text = parts.plain ?? (parts.html ? htmlToText(parts.html) : "");
+      const lines = [];
+      for (const line of text.split(/\r?\n/)) {
+        const t = line.trim();
+        if (t === "--" || t === "-- ")
+          break;
+        if (/^On .+wrote:$/i.test(t) || /^-{2,} ?Original Message ?-{2,}$/i.test(t) || /^From: .+/.test(t) && lines.length > 0)
+          break;
+        if (t.startsWith(">"))
+          continue;
+        lines.push(line.trimEnd());
+      }
+      return lines.join("\n").replace(/\n{3,}/g, "\n\n").trim().slice(0, 4e3);
+    }
+    function parseJson(text) {
+      const m = text.match(/\{[\s\S]*\}/);
+      if (!m)
+        return null;
+      try {
+        const j = JSON.parse(m[0]);
+        const intents = ["interested", "price_question", "question", "change_request", "not_interested", "unsubscribe", "auto_reply", "other"];
+        return {
+          intent: intents.includes(j.intent) ? j.intent : "other",
+          confidence: Math.max(0, Math.min(1, Number(j.confidence) || 0)),
+          summary: String(j.summary ?? "").slice(0, 300),
+          reply_subject: j.reply_subject ? String(j.reply_subject) : null,
+          reply_body: j.reply_body ? String(j.reply_body) : null
+        };
+      } catch {
+        return null;
+      }
+    }
+    async function analyse(msg, deps) {
+      const db2 = (0, db_1.getDb)();
+      const lead = db2.get("SELECT name, type, city, status, site_url, booking_url, handed_over_at FROM leads WHERE id = ?", [msg.lead_id]);
+      if (!lead)
+        return null;
+      const s = (0, guardrails_1.getAutopilotSettings)();
+      const agency2 = (0, agency_1.getAgencyProfile)();
+      const history = getThread(msg.lead_id).filter((m) => m.id !== msg.id).slice(-6).map((m) => `${m.direction === "out" ? "US" : "THEM"} (${m.at.slice(0, 10)}): ${(m.body ?? "").slice(0, 1200)}`).join("\n\n");
+      const isClient = !!lead.handed_over_at || lead.status === "won";
+      const prompt = `You handle email replies for ${agency2.name ?? "a small web design studio"}, which builds websites for local businesses.
+
+Business you're talking to: ${lead.name}${lead.type ? ` (${lead.type})` : ""}${lead.city ? `, ${lead.city}` : ""}.
+${isClient ? "They are already a paying client." : `They're a prospect. We built them a free demo site${lead.site_url ? `: ${lead.site_url}` : ""}.`}
+
+Pricing you may quote (never discount or promise anything else):
+- Website made live on their own domain: ${(0, agency_1.formatMoney)(s.sitePence, agency2.currency)} one-off.
+${s.carePence > 0 ? `- Optional care plan (hosting, updates, small edits): ${(0, agency_1.formatMoney)(s.carePence, agency2.currency)} a month.` : "- Hosting is included for the first year."}
+${s.callUrl ? `Call booking link: ${s.callUrl}` : "No call booking link \u2014 offer to reply by email or ask for a good time to call."}
+
+Earlier emails:
+${history || "(none stored)"}
+
+Their new email:
+${(msg.body ?? "").slice(0, 3e3)}
+
+Classify the new email and, unless it's an unsubscribe, an auto-reply or a clear no, write the reply we should send.
+
+Intents: interested (wants to go ahead or keen), price_question, question (anything else they ask), change_request (wants changes to the site), not_interested, unsubscribe (asks not to be contacted), auto_reply (out-of-office or automated), other.
+
+Reply rules:
+- Plain, friendly, professional British English. Short: 60\u2013140 words. No hype, no pressure.
+- Answer exactly what they asked. If you don't know something (dates, technical specifics not given above), say we'll confirm rather than inventing it.
+- If they're interested or asking the price and want to proceed, include the literal placeholder {payment_link} on its own line as the way to go ahead.
+- Use {call_link} only if a call booking link exists above.
+- Sign off as ${agency2.name ?? "the team"}.
+- Never claim results, guarantees or testimonials.
+
+Respond with JSON only:
+{"intent": "...", "confidence": 0.0-1.0, "summary": "one sentence on what they want", "reply_subject": "Re: ..." or null, "reply_body": "..." or null}`;
+      const res = await (0, llm_1.generateText)({ apiKey: deps.apiKey, prompt, maxTokens: 1500, timeoutMs: 12e4 });
+      return parseJson(res.text);
+    }
+    function fill(body, links) {
+      let out = body;
+      out = links.payment ? out.replace(/\{payment_link\}/g, links.payment) : out.split("\n").filter((l) => !l.includes("{payment_link}")).join("\n");
+      out = links.call ? out.replace(/\{call_link\}/g, links.call) : out.split("\n").filter((l) => !l.includes("{call_link}")).join("\n");
+      return out.trim();
+    }
+    async function runReplyAgent(deps) {
+      const settings = (0, guardrails_1.getAutopilotSettings)();
+      if (settings.replyMode === "off")
+        return { processed: 0, sent: 0 };
+      const db2 = (0, db_1.getDb)();
+      const pending = db2.all("SELECT * FROM messages WHERE direction = 'in' AND handled = 'new' ORDER BY at ASC LIMIT 10", []);
+      let processed = 0;
+      let sent = 0;
+      for (const msg of pending) {
+        let a = null;
+        try {
+          a = await analyse(msg, deps);
+        } catch (e) {
+          (0, guardrails_1.logActivity)({ action: "Couldn't read reply", leadId: msg.lead_id, detail: e.message, needsYou: true });
+        }
+        if (!a) {
+          db2.run("UPDATE messages SET handled = 'needs_you' WHERE id = ?", [msg.id]);
+          continue;
+        }
+        processed++;
+        db2.run("UPDATE messages SET intent = ?, intent_summary = ?, confidence = ? WHERE id = ?", [a.intent, a.summary, a.confidence, msg.id]);
+        if (a.intent === "unsubscribe" || a.intent === "not_interested") {
+          if (msg.from_addr)
+            (0, guardrails_1.suppress)(msg.from_addr, a.intent === "unsubscribe" ? "unsubscribed" : "not interested", msg.lead_id);
+          (0, followup_1.logContact)({ leadId: msg.lead_id, direction: "in", channel: "email", outcome: "not_interested", note: a.summary });
+          db2.run("UPDATE messages SET handled = 'done' WHERE id = ?", [msg.id]);
+          (0, guardrails_1.logActivity)({ action: a.intent === "unsubscribe" ? "Unsubscribed \u2014 won't be contacted again" : "Not interested \u2014 closed", leadId: msg.lead_id, detail: a.summary });
+          continue;
+        }
+        if (a.intent === "auto_reply") {
+          db2.run("UPDATE messages SET handled = 'ignored' WHERE id = ?", [msg.id]);
+          continue;
+        }
+        if (a.intent === "interested") {
+          (0, followup_1.logContact)({ leadId: msg.lead_id, direction: "in", channel: "email", outcome: "interested", note: a.summary });
+        }
+        let body = a.reply_body ?? "";
+        let payment = null;
+        if (body.includes("{payment_link}") && settings.sendProposals) {
+          try {
+            payment = await deps.createPaymentLink(msg.lead_id);
+          } catch (e) {
+            (0, guardrails_1.logActivity)({ action: "Couldn't create payment link", leadId: msg.lead_id, detail: e.message, needsYou: true });
+          }
+        }
+        body = fill(body, { payment, call: settings.callUrl });
+        const subject = a.reply_subject || `Re: ${msg.subject ?? ""}`.trim();
+        db2.run("UPDATE messages SET draft_subject = ?, draft_body = ?, handled = 'drafted' WHERE id = ?", [subject, body, msg.id]);
+        const canAuto = settings.replyMode === "auto" && AUTO_SENDABLE.includes(a.intent) && a.confidence >= settings.minConfidence && !!body && !(0, guardrails_1.isSuppressed)(msg.from_addr) && !(0, guardrails_1.sendBlockedReason)();
+        if (canAuto) {
+          const r = await sendDraft(msg.id, { subject, body }, deps.smtp, "autopilot");
+          if (r.ok) {
+            sent++;
+            (0, guardrails_1.logActivity)({ action: `Replied automatically (${a.intent.replace("_", " ")})`, leadId: msg.lead_id, detail: a.summary });
+            continue;
+          }
+          (0, guardrails_1.logActivity)({ action: "Auto-reply failed to send", leadId: msg.lead_id, detail: r.error, needsYou: true });
+        }
+        const why = settings.replyMode === "draft" ? "Draft ready for you to check" : !AUTO_SENDABLE.includes(a.intent) ? `Needs you (${a.intent.replace("_", " ")})` : a.confidence < settings.minConfidence ? "Needs you (agent wasn't sure)" : (0, guardrails_1.sendBlockedReason)() ?? "Needs you";
+        (0, guardrails_1.logActivity)({ action: why, leadId: msg.lead_id, detail: a.summary, needsYou: true });
+      }
+      if (processed)
+        deps.emit?.("inbox:changed", { processed, sent });
+      return { processed, sent };
+    }
+    async function sendDraft(messageId, content, smtp, sentBy) {
+      if (!smtp)
+        return { ok: false, error: "Set up email sending in Settings first." };
+      const db2 = (0, db_1.getDb)();
+      const msg = db2.get("SELECT * FROM messages WHERE id = ?", [messageId]);
+      if (!msg)
+        return { ok: false, error: "Message not found." };
+      if (!msg.from_addr)
+        return { ok: false, error: "No address to reply to." };
+      if ((0, guardrails_1.isSuppressed)(msg.from_addr))
+        return { ok: false, error: "This address is on the do-not-contact list." };
+      if (sentBy === "autopilot") {
+        const blocked = (0, guardrails_1.sendBlockedReason)();
+        if (blocked)
+          return { ok: false, error: blocked };
+      }
+      const res = await (0, email_1.sendEmail)(smtp, {
+        to: msg.from_addr,
+        subject: content.subject,
+        text: content.body,
+        inReplyTo: msg.message_id,
+        references: msg.message_id
+      });
+      if (!res.ok)
+        return { ok: false, error: res.error };
+      recordOutgoing({
+        leadId: msg.lead_id,
+        to: msg.from_addr,
+        from: smtp.from,
+        subject: content.subject,
+        body: content.body,
+        messageId: res.messageId,
+        inReplyTo: msg.message_id,
+        sentBy
+      });
+      db2.run("UPDATE messages SET handled = 'replied', draft_subject = ?, draft_body = ? WHERE id = ?", [content.subject, content.body, messageId]);
+      (0, followup_1.logContact)({ leadId: msg.lead_id, direction: "out", channel: "email", note: content.subject });
+      return { ok: true };
+    }
+    function dismissMessage(messageId) {
+      (0, db_1.getDb)().run("UPDATE messages SET handled = 'done' WHERE id = ?", [messageId]);
+    }
+    function resetForAgent(messageId) {
+      (0, db_1.getDb)().run("UPDATE messages SET handled = 'new', draft_subject = NULL, draft_body = NULL WHERE id = ? AND direction = 'in'", [messageId]);
+    }
+    async function sendFollowUps(args) {
+      if (!args.smtp)
+        return { sent: 0, skipped: 0, error: "Email sending isn't set up." };
+      const db2 = (0, db_1.getDb)();
+      const due = db2.all(`SELECT id, name, email, site_url, booking_url, last_email_message_id
+       FROM leads
+      WHERE last_contacted_at IS NOT NULL
+        AND last_reply_at IS NULL AND replied_at IS NULL
+        AND status NOT IN ('dead','won')
+        AND COALESCE(followed_up_count, 0) <= 1
+        AND email IS NOT NULL AND email != ''
+        AND julianday('now') - julianday(last_contacted_at) >= ?
+      ORDER BY last_contacted_at ASC
+      LIMIT ?`, [args.afterDays, args.limit]);
+      const agency2 = (0, agency_1.getAgencyProfile)().name ?? "";
+      let sent = 0;
+      let skipped = 0;
+      for (const l of due) {
+        if ((0, guardrails_1.isSuppressed)(l.email)) {
+          skipped++;
+          continue;
+        }
+        const blocked = (0, guardrails_1.sendBlockedReason)();
+        if (blocked)
+          return { sent, skipped: skipped + (due.length - sent - skipped), error: blocked };
+        const link = l.site_url || l.booking_url || "";
+        const subject = `Following up \u2014 ${l.name}`;
+        const body = [
+          "Hello,",
+          "",
+          `Just following up on the free demo website I put together for ${l.name}${link ? `:
+${link}` : "."}`,
+          "",
+          `Happy to answer any questions or make changes. If it's not for you, just reply "no thanks" and I won't get in touch again.`,
+          "",
+          "Best regards",
+          agency2
+        ].join("\n");
+        const res = await (0, email_1.sendEmail)(args.smtp, {
+          to: l.email,
+          subject,
+          text: body,
+          inReplyTo: l.last_email_message_id,
+          references: l.last_email_message_id
+        });
+        if (!res.ok) {
+          (0, guardrails_1.logActivity)({ action: "Follow-up failed to send", leadId: l.id, detail: res.error });
+          skipped++;
+          continue;
+        }
+        recordOutgoing({ leadId: l.id, to: l.email, from: args.smtp.from, subject, body, messageId: res.messageId ?? null, inReplyTo: l.last_email_message_id, sentBy: "autopilot" });
+        (0, followup_1.logContact)({ leadId: l.id, direction: "out", channel: "email", note: "follow-up" });
+        (0, guardrails_1.logActivity)({ action: "Sent a follow-up", leadId: l.id });
+        sent++;
+      }
+      return { sent, skipped };
+    }
+  }
+});
+
 // ../desktop/dist/main/lib/chat-tools.js
 var require_chat_tools = __commonJS({
   "../desktop/dist/main/lib/chat-tools.js"(exports2) {
@@ -95727,6 +96308,8 @@ var require_chat_tools = __commonJS({
     var site_stats_1 = require_site_stats();
     var email_1 = require_email();
     var email_harvest_1 = require_email_harvest();
+    var guardrails_1 = require_guardrails();
+    var inbox_1 = require_inbox();
     exports2.TOOLS = [
       {
         name: "find_leads",
@@ -95806,7 +96389,7 @@ var require_chat_tools = __commonJS({
       },
       {
         name: "whatsapp_message",
-        description: "Generate a pre-filled WhatsApp message link for a lead. Returns a URL the user can open. Doesn't actually send.",
+        description: "Generate a pre-filled WhatsApp message link for a lead. Only use this when the user explicitly asks for WhatsApp \u2014 outreach is email by default. Returns a URL the user can open. Doesn't actually send.",
         input_schema: {
           type: "object",
           properties: {
@@ -95833,7 +96416,7 @@ var require_chat_tools = __commonJS({
             channel: {
               type: "string",
               enum: ["email", "whatsapp", "sms"],
-              description: "Preferred channel. 'email' (default) sends via the user's SMTP \u2014 the only channel that works unattended on every platform \u2014 falling back to a WhatsApp link for leads with no email address. 'whatsapp' opens WhatsApp and 'sms' opens the device's Messages app (Messages on macOS, Phone Link on Windows); both fall back to email when a lead has no phone. Omit to use the saved preference."
+              description: "Preferred channel. 'email' (default, and the professional choice) sends via the user's SMTP \u2014 the only channel that works unattended on every platform. Leads with no email address are reported as unreachable, never switched to WhatsApp. 'whatsapp' opens WhatsApp and 'sms' opens the device's Messages app (Messages on macOS, Phone Link on Windows); both fall back to email when a lead has no phone. Omit to use the saved preference."
             }
           }
         },
@@ -96202,11 +96785,19 @@ Want it live on your own domain?`;
     }
     function outreachTemplate(db2) {
       const row = db2.get("SELECT value FROM settings WHERE key = ?", ["outreach_template"]);
-      return row?.value ?? `Hi, we built {name} a free demo website: {site_url}
+      return row?.value ?? `Hello,
+
+I came across {name} on Google and noticed you don't have a website yet, so I put together a free demo to show what one could look like:
+
+{site_url}
+
+It's built from your real reviews and photos. If you like it, I can put it live on your own domain with your details for a one-off fee of \xA3199 \u2014 no monthly charges.
 
-It's not fully live yet. We can make it live for \xA3199 \u2014 your own domain, photos & content. One-time fee.
+Would you be open to a quick chat this week?
 
-Interested?`;
+Best regards
+
+If you'd rather not hear from me again, just reply and let me know.`;
     }
     function normaliseChannel(value) {
       switch (String(value ?? "").toLowerCase()) {
@@ -96352,11 +96943,19 @@ Interested?`;
           const phone = (lead.phone ?? "").replace(/[^\d+]/g, "");
           const e164 = phone.startsWith("+") ? phone : phone.startsWith("0") ? `+44${phone.slice(1)}` : phone;
           const tplRow = db2.get("SELECT value FROM settings WHERE key = ?", ["outreach_template"]);
-          const template = tplRow?.value ?? `Hi, we built {name} a free demo website: {site_url}
+          const template = tplRow?.value ?? `Hello,
+
+I came across {name} on Google and noticed you don't have a website yet, so I put together a free demo to show what one could look like:
+
+{site_url}
+
+It's built from your real reviews and photos. If you like it, I can put it live on your own domain with your details for a one-off fee of \xA3199 \u2014 no monthly charges.
+
+Would you be open to a quick chat this week?
 
-It's not fully live yet. We can make it live for \xA3199 \u2014 your own domain, photos & content. One-time fee.
+Best regards
 
-Interested?`;
+If you'd rather not hear from me again, just reply and let me know.`;
           const body = input.message ?? template.replace(/\{name\}/g, lead.name).replace(/\{site_url\}/g, lead.site_url ?? "");
           const url = `https://wa.me/${e164.replace(/^\+/, "")}?text=${encodeURIComponent(body)}`;
           return { url, message: body, phone: e164 };
@@ -96383,7 +96982,7 @@ Interested?`;
           const template = outreachTemplate(db2);
           const bookingTemplate = bookingOutreachTemplate(db2);
           const preferEmail = channel === "email";
-          const linkChannel = channel === "email" ? "whatsapp" : channel;
+          const linkChannel = channel === "email" ? null : channel;
           const smtp = (0, email_1.smtpFromSettings)((k) => getDecryptedSetting(k));
           const emailSubject = getDecryptedSetting("outreach_email_subject") || "A free demo website for {name}";
           const prepared = [];
@@ -96409,9 +97008,17 @@ Interested?`;
                 harvested++;
               }
             }
+            if (r.email && (0, guardrails_1.isSuppressed)(r.email)) {
+              prepared.push({ id: r.id, name: r.name, via: "none", email: r.email, message, emailError: "On the do-not-contact list" });
+              continue;
+            }
+            if (preferEmail && (0, guardrails_1.emailsSentToday)() >= (0, guardrails_1.getAutopilotSettings)().maxEmailsPerDay) {
+              prepared.push({ id: r.id, name: r.name, via: "none", email: r.email ?? void 0, message, emailError: "Daily email limit reached \u2014 try again tomorrow" });
+              continue;
+            }
             const leadEmail = smtp && r.email ? r.email : null;
             const useEmail = leadEmail !== null && (preferEmail || !e164);
-            if (!useEmail && e164) {
+            if (!useEmail && e164 && linkChannel) {
               prepared.push({
                 id: r.id,
                 name: r.name,
@@ -96423,11 +97030,16 @@ Interested?`;
             } else if (useEmail && smtp && leadEmail) {
               const subject = emailSubject.replace(/\{name\}/g, r.name);
               const res = await (0, email_1.sendEmail)(smtp, { to: leadEmail, subject, text: message });
-              if (res.ok && res.messageId) {
-                db2.run("UPDATE leads SET last_email_message_id = ? WHERE id = ?", [
-                  res.messageId,
-                  r.id
-                ]);
+              if (res.ok) {
+                (0, inbox_1.recordOutgoing)({
+                  leadId: r.id,
+                  to: leadEmail,
+                  from: smtp.from,
+                  subject,
+                  body: message,
+                  messageId: res.messageId ?? null,
+                  sentBy: "outreach"
+                });
               }
               prepared.push({
                 id: r.id,
@@ -96457,7 +97069,7 @@ Interested?`;
               (0, followup_1.logContact)({
                 leadId: r.id,
                 direction: "out",
-                channel: last.via === "email" ? "email" : linkChannel
+                channel: last.via === "email" ? "email" : linkChannel ?? "sms"
               });
             }
           }
@@ -96890,7 +97502,7 @@ var require_chat = __commonJS({
     var sdk_1 = __importDefault(require_sdk());
     var chat_tools_1 = require_chat_tools();
     var models_1 = require_models();
-    var SYSTEM_PROMPT = `You are Sproutkit's built-in assistant \u2014 STRICTLY scoped to helping the user run their lead-generation, website-building, and outreach work inside the Sproutkit app.
+    var SYSTEM_PROMPT = `You are Sprout, Sproutkit's built-in assistant (the operator's friendly sidekick) \u2014 STRICTLY scoped to helping the user run their lead-generation, website-building, and outreach work inside the Sproutkit app.
 
 You can do the user's real work through tools \u2014 you are not a help desk pointing at buttons. Many users prefer chatting to using the UI, so if something can be done with a tool, DO IT.
 
@@ -96937,7 +97549,7 @@ Confirmation rules:
 You can help with:
 - Finding leads (running the search itself, plus strategy, categories, filtering)
 - Building demo websites (design ideas, copy suggestions, fixing issues)
-- Outreach (drafting WhatsApp / SMS / email messages, follow-ups, kanban moves)
+- Outreach (email by default \u2014 draft and send professional emails; only use WhatsApp/SMS when the user asks; follow-ups, kanban moves)
 - The CMS, claim flow, customer onboarding
 - Sproutkit features and how to use them
 - Pricing, business advice for selling websites to local small businesses
@@ -96946,7 +97558,7 @@ STAYING ON THE RAILS \u2014 you are capable, but you only act through the tools
 - You can ONLY do what a tool does. If a request maps to a tool (even loosely, via an instructions field), do it. If NO tool fits \u2014 e.g. "run their Google Ads", "post to their Instagram", "phone the owner", "take payment" \u2014 say so plainly in one line and name the closest thing you CAN do. Example: "I can't run ads, but I can build them a site and draft the outreach \u2014 want that?"
 - NEVER claim to have done something you have no tool for. NEVER invent a result, URL, price, or status. If you didn't get it from a tool result, don't state it as fact.
 - Don't drift into general marketing consultancy, coding help, or business strategy essays. A one-line pointer is fine; a lecture is not.
-- Refuse anything genuinely off-topic (general coding, creative writing, personal advice, news, politics) briefly: "I'm Sproutkit's assistant \u2014 I help with finding leads, building sites, booking, and outreach. What would you like to do?" and stop.
+- Refuse anything genuinely off-topic (general coding, creative writing, personal advice, news, politics) briefly: "I'm Sprout, Sproutkit's assistant \u2014 I help with finding leads, building sites, booking, and outreach. What would you like to do?" and stop.
 
 Be concise, action-oriented, and use plain English. Never apologise excessively. Never lecture.
 
@@ -98365,7 +98977,7 @@ var require_package2 = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "sproutkit-code",
-      version: "1.9.1",
+      version: "1.10.0",
       description: "Sproutkit in your terminal \u2014 find leads, build sites, run outreach, all via chat.",
       bin: {
         sproutkit: "./dist/index.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sproutkit-code",
-  "version": "1.9.1",
+  "version": "1.10.0",
   "description": "Sproutkit in your terminal — find leads, build sites, run outreach, all via chat.",
   "bin": {
     "sproutkit": "./dist/index.js"