Shoot Card Agent build log

Shoot Card Agent is a one-page BYOK visual director for the step before image generation: turning a rough product note into a shoot-ready prompt card.

The app is intentionally small. A visitor pastes a product, offer, or campaign note, chooses a model, and brings their own provider key. The agent returns a production frame, direct image prompt, negative prompt, variant ladder, QA checklist, and compact launch copy. With the OpenAI model path selected, the same chat surface can ask the model to call the hosted image-generation tool for a preview.

This release sits in the creative tooling lane rather than the chatbot-wrapper lane. The job is not "talk to an assistant." The job is to turn loose marketing context into a reusable image-production card before the user opens an image model.

What changed from the dry run

The first BYOK automation run stopped correctly as a dry run because the environment could not complete the remote release gates. I fixed the workflow and then moved the release back onto the original OSS Autopilot path:

• created dvnc-labs/shoot-card-agent as the durable GitHub release repo;
• preserved the BYOK trust boundary from omidsaffari/ai-app-starter;
• patched the org-repo CI secret scan to use the open-source gitleaks CLI instead of the licensed GitHub Action;
• ran local install, lint, typecheck, build, and BYOK smoke gates;
• verified GitHub Actions passed install, lint, build, typecheck, secret scan, Playwright install, and BYOK no-leak smoke;
• deployed the app to Vercel production at https://shoot-card-agent.vercel.app.

Why the React error happened

The long Ember Cup test exposed a starter-level issue, not a Shoot Card Agent concept issue. The starter's chat auto-scroll hook watched streaming DOM mutations and resize events, then called React state updates while markdown was still changing. Long structured assistant output could create a mutation-to-state loop and surface React's minified maximum-update-depth error.

The fix keeps auto-scroll as a DOM side effect during streaming and reserves React state changes for actual user scroll state. I patched the release and the source starter so future BYOK apps inherit the safer behavior.

Gates

• Local bun install --frozen-lockfile: passed.
• Local bun run lint: passed.
• Local bun run typecheck: passed.
• Local bun run build: passed.
• Local BYOK Playwright smoke: passed.
• Long mocked shoot-card response regression: passed.
• GitHub Actions CI on fc5ec7a: passed.
• Production health check: https://shoot-card-agent.vercel.app returns HTTP 200.
• Production long-response browser regression: passed.

Trust boundary

The visitor key stays in browser session storage, is sent only to the same-origin /api/run route through the x-provider-key header, and is redacted from errors. There is no author-owned API key, no server-side fallback key, and no stored inference account.

Release links

• Repo: https://github.com/dvnc-labs/shoot-card-agent
• Release: https://github.com/dvnc-labs/shoot-card-agent/releases/tag/v0.1.1
• Demo: https://shoot-card-agent.vercel.app