fix: harden generated sites and contact form mail

Author: superdav42

includes/Abilities/ContentAbilities.php

@@ -640,13 +640,15 @@ private static function build_wpforms_form_data( string $title, string $recipien
 	 */
 	private static function create_contact_form_7_form( string $cf7_class, string $title, string $recipient_email, string $submit_label ): array {
 		$form_markup = self::build_contact_form_7_markup( $submit_label );
+		$sender      = self::contact_form_sender_address();
 		$mail        = [
 			'subject'            => sprintf(
 				/* translators: %s: contact form title */
 				__( '%s submission', 'superdav-ai-agent' ),
 				$title
 			),
-			'sender'             => '[your-name] <[your-email]>',
+			// Keep the visitor address in Reply-To; using it as From fails DMARC/SPF.
+			'sender'             => $sender,
 			'body'               => "From: [your-name] <[your-email]>\nSubject: [your-subject]\n\nMessage:\n[your-message]",
 			'recipient'          => $recipient_email,
 			'additional_headers' => 'Reply-To: [your-email]',
@@ -708,6 +710,22 @@ private static function create_contact_form_7_form( string $cf7_class, string $t
 		];
 	}
 
+	/**
+	 * Return a same-site sender address for generated forms.
+	 *
+	 * @return string Sender in Contact Form 7's "Name <address>" format.
+	 */
+	private static function contact_form_sender_address(): string {
+		$host = (string) wp_parse_url( home_url( '/' ), PHP_URL_HOST );
+		$host = strtolower( preg_replace( '/[^a-z0-9.-]/i', '', $host ) ?? '' );
+		if ( '' === $host ) {
+			$host = 'localhost';
+		}
+		$name = wp_specialchars_decode( get_bloginfo( 'name' ), ENT_QUOTES );
+		$name = '' !== $name ? $name : __( 'Website', 'superdav-ai-agent' );
+		return sprintf( '%s <wordpress@%s>', $name, $host );
+	}
+
 	/**
 	 * Build Contact Form 7 form markup.
 	 *

includes/Core/SystemInstructionBuilder.php

@@ -569,6 +569,10 @@ public static function default_system_instruction(): string {
 			. "- **To set a static front page:** (1) Create a page titled \"Home\" or similar using `sd-ai-agent/create-post` with post_type=\"page\". (2) Get its post ID from the response. (3) Use `sd-ai-agent/update-option` twice: first with option_name=\"show_on_front\" and option_value=\"page\", then with option_name=\"page_on_front\" and option_value=<post_id>.\n"
 			. "- **To create and assign a navigation menu:** (1) Use `sd-ai-agent/create-menu` with the menu name (e.g. \"Main Menu\"). (2) Add menu items using `sd-ai-agent/add-menu-item` for each page/link. (3) Assign the menu to a theme location using `sd-ai-agent/assign-menu-location` (e.g. location=\"primary\" or \"header\").\n"
 			. "- Always verify these settings are actually applied before claiming completion.\n\n"
+			. "## Launch-quality website checks (MANDATORY)\n"
+			. "- Do not leave theme starter content in a client site. Inspect the rendered header and footer after building. Remove or replace every placeholder label/link (for example Careers, Brand Assets, Features, Pricing, Demo, Visit Ollie, or links to the theme vendor) unless it points to a real page or a URL the user explicitly supplied. Every visible footer link must resolve to an existing published page or a valid intended external URL; remove unsupported links rather than inventing destinations.\n"
+			. "- After creating a contact form, insert the returned `block` or `shortcode` into the Contact/booking page with `sd-ai-agent/update-post`, then fetch the public page and verify the form is actually rendered. Submit a test payload when the environment permits it. If mail transport, recipient suppression, or SMTP configuration prevents delivery, report that exact limitation and do not claim the form is working; preserve the visitor's email as Reply-To and use a same-domain From address.\n"
+			. "- Before reporting completion, crawl the public pages you created (including the footer) and check internal links, form presence, heading structure, and absence of sample/theme-vendor content. Fix failures and re-check rather than merely describing them.\n\n"
 			. "## Tips\n"
 			. "- Chain operations: create content first, then configure settings.\n"
 			. "- After completing all steps, summarize what was done with links to the created resources.\n\n"

tests/SdAiAgent/Core/SystemInstructionBuilderTest.php

@@ -83,6 +83,9 @@ public function test_default_system_instruction_includes_site_configuration_guid
 			$instruction,
 			'System instruction should include honesty principle about claiming completion'
 		);
+		$this->assertStringContainsString( 'Launch-quality website checks (MANDATORY)', $instruction );
+		$this->assertStringContainsString( 'placeholder label/link', $instruction );
+		$this->assertStringContainsString( 'same-domain From address', $instruction );
 	}
 
 	/**