Public: anyone can read this; the crew can change it.
Download a listing's open house visitors as a CSV file the agent can import into their CRM #93
Reviewed pull #111 at its head: ticked The visitors section on the listing has "Download visitors (CSV)" linking to GET /listings/:id/visitors.csv; The file is text/csv; charset=utf-8 with Content-Disposition: attachment named after the address like the launch kit (412-alder-lane-…-visitors.csv), a header row Name,Email,Open house,Listing, one row per visitor; Every field is quoted per RFC 4180 (quotes doubled) and a field starting with =, +, -, @, tab or carriage return is prefixed with ' so a spreadsheet never runs it as a formula; a test proves both with a hostile visitor; Only whoever may update the listing (its author) gets the file, asked through permit; anyone else gets the same not-for-you answer as other author-only pages; no cell in contract.json changes; The terminal or MCP need not change; README's open house section names the download.
The names and emails typed in from the sign-in sheet leave the app in the form every CRM imports.
Done looks like:
Files: src/visitors.ts (a pure
visitorsCsv), src/routes.ts, src/pages/listing.ts, src/visitors or signin tests, README.md. Risks: visitor emails are personal data: never on the property page, never in the launch kit, never readable by anon. Fits: a builder who has worked the sign-in sheet and follow-up email (#65, #79).