@gafj/gafj 0.1.19 → 0.1.21

package/bin/cli.js

@@ -321,6 +321,7 @@ async function main(argv) {
     const { createHostedServer } = require("../http/hosted");
     const { firebaseVerifier } = require("../http/identity");
     const { Log } = require("../store/log");
+    const pkg = require("../package.json");
     const env = process.env;
     const root = env.GAFJ_HOSTED_ROOT || "/data";
     if (!env.GAFJ_FIREBASE_PROJECT_ID) { process.stderr.write("serve-hosted needs GAFJ_FIREBASE_PROJECT_ID (and GAFJ_FIREBASE_API_KEY, GAFJ_FIREBASE_AUTH_DOMAIN for the sign-in page)\n"); process.exit(2); }

package/core/scoring.js

@@ -128,8 +128,10 @@ function conceptTags(requirementText) {
   return hit;
 }
 
+/** Lines a job board adds around a posting; never a requirement of the job. */
+const BOARD_NOISE = /\b(your profile and resume match|see how you compare|applicants?\b.*\b(ago|clicked)|easy apply|promoted by|reposted|set alert for similar|show more|show less|tailor my resume|help me stand out|create cover letter|people you can reach out to|meet the hiring team|skills you have|sign in to|referrals increase)\b/i;
 function lines(text) {
-  return String(text).split(/\r?\n|(?<=[.;])\s{2,}/).map((l) => l.trim()).filter(Boolean);
+  return String(text).split(/\r?\n|(?<=[.;])\s{2,}/).map((l) => l.trim()).filter((l) => l && !BOARD_NOISE.test(l));
 }
 
 /** Every figure in a document: money, percents, counts, durations. */

package/http/guard.js

@@ -91,7 +91,7 @@ function readJson(req, cap = BODY_CAP) {
     const chunks = [];
     req.on("data", (c) => {
       size += c.length;
-      if (size > cap) { reject(Object.assign(new Error("body larger than 1 MB"), { status: 413 })); req.destroy(); return; }
+      if (size > cap) { req.removeAllListeners("data"); req.resume(); reject(Object.assign(new Error(`body larger than ${Math.round(cap / 1024 / 1024)} MB; paste less`), { status: 413 })); return; }
       chunks.push(c);
     });
     req.on("end", () => {

package/http/hosted.js

@@ -34,8 +34,34 @@ const { UI_DIR } = require("./server");
 const COOKIE = "gafj_hs";
 const SESSION_TTL_MS = 30 * 24 * 3600 * 1000;
 const IDLE_CLOSE_MS = 10 * 60 * 1000;
-const SIGNIN_CSP = "default-src 'self'; script-src 'self' https://www.gstatic.com https://apis.google.com; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self' https://identitytoolkit.googleapis.com https://securetoken.googleapis.com https://www.googleapis.com https://apis.google.com; frame-src https://*.firebaseapp.com https://accounts.google.com; frame-ancestors 'none'; base-uri 'none'; form-action 'self'; object-src 'none'";
+const SIGNIN_CSP = "default-src 'self'; script-src 'self' https://www.gstatic.com https://apis.google.com; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self' https://identitytoolkit.googleapis.com https://securetoken.googleapis.com https://www.googleapis.com https://apis.google.com; frame-src 'self' https://*.firebaseapp.com https://accounts.google.com; frame-ancestors 'none'; base-uri 'none'; form-action 'self'; object-src 'none'";
 const MIME = { ".html": "text/html; charset=utf-8", ".js": "text/javascript; charset=utf-8", ".mjs": "text/javascript; charset=utf-8", ".css": "text/css; charset=utf-8", ".json": "application/json; charset=utf-8", ".svg": "image/svg+xml", ".png": "image/png", ".webmanifest": "application/manifest+json", ".ico": "image/x-icon", ".woff2": "font/woff2" };
+/**
+ * Google sign-in's handler pages live on <project>.firebaseapp.com. Served from another site, the
+ * popup and redirect flows depend on third-party storage that browsers now block, so the app
+ * serves them itself: everything under /__/ is fetched from Firebase and passed through, and the
+ * sign-in page uses this host as its auth domain. Firebase's own headers come back with the page;
+ * only hop-by-hop and cookie headers are dropped.
+ */
+const PASS_REQ = new Set(["accept", "accept-language", "content-type", "content-length", "referer", "user-agent", "x-requested-with", "origin"]);
+const DROP_RES = new Set(["set-cookie", "transfer-encoding", "connection", "keep-alive", "content-encoding", "content-length", "strict-transport-security", "alt-svc"]);
+async function proxyAuth(req, res, { projectId, fetchImpl, originOf }) {
+  const upstream = `https://${projectId}.firebaseapp.com${req.url}`;
+  const headers = {};
+  for (const [k, v] of Object.entries(req.headers)) if (PASS_REQ.has(k)) headers[k] = v;
+  if (headers.origin) headers.origin = `https://${projectId}.firebaseapp.com`;
+  if (headers.referer) headers.referer = headers.referer.replace(originOf, `https://${projectId}.firebaseapp.com`);
+  headers["accept-encoding"] = "identity";
+  const body = req.method === "GET" || req.method === "HEAD" ? undefined : await new Promise((resolve, reject) => { const c = []; req.on("data", (d) => c.push(d)); req.on("end", () => resolve(Buffer.concat(c))); req.on("error", reject); });
+  const r = await fetchImpl(upstream, { method: req.method, headers, body, redirect: "manual" });
+  const out = {};
+  for (const [k, v] of r.headers.entries()) if (!DROP_RES.has(k.toLowerCase())) out[k] = v;
+  const buf = Buffer.from(await r.arrayBuffer());
+  out["content-length"] = String(buf.length);
+  res.writeHead(r.status, out);
+  return res.end(buf);
+}
+
 const BLOCKED_IN_HOSTED = [/^\/api\/settings\/providers/, /^\/api\/mcp-config$/, /^\/api\/restore-test$/];
 
 function json(res, status, body) {
@@ -157,7 +183,9 @@ function createHostedServer(o) {
     res.on("finish", () => log.write(res.statusCode >= 500 ? "error" : res.statusCode >= 400 ? "warn" : "info", "request",
       { entity: "http", entity_id: `${req.method} ${p}`, actor: who ? "user" : "anon", ms: Date.now() - started, status: res.statusCode }));
     try {
+      if (p === "/healthz" && req.method === "GET") return json(res, 200, { ok: true, version: o.version }); // the platform's check arrives under its own host name
       if (host && String(req.headers.host || "").toLowerCase() !== host) return json(res, 421, { error: "wrong host" });
+      if (p.startsWith("/__/") && o.firebase && o.firebase.projectId) return proxyAuth(req, res, { projectId: o.firebase.projectId, fetchImpl: o.fetch || fetch, originOf: originOf(req) });
       const mutation = req.method !== "GET" && req.method !== "HEAD";
       securityHeaders(res, { noStore: isApi || p.startsWith("/auth/") || p.startsWith("/account/") });
 
@@ -166,7 +194,8 @@ function createHostedServer(o) {
         res.writeHead(200, { "Content-Type": MIME[".html"], "Cache-Control": "no-cache" });
         return fs.createReadStream(path.join(UI_DIR, "hosted", "signin.html")).pipe(res);
       }
-      if (p === "/signin/config.json") return json(res, 200, { firebase: o.firebase || null, signed_in: !!sessionOf(req) });
+      // the auth domain is this host, so Google's handler pages come through the proxy above and stay same-site
+      if (p === "/signin/config.json") return json(res, 200, { firebase: o.firebase ? { ...o.firebase, authDomain: String(req.headers.host || o.firebase.authDomain || "").toLowerCase() } : null, signed_in: !!sessionOf(req) });
       if (p === "/auth/session" && req.method === "POST") {
         const g = mutationCheck(req);
         if (g) return json(res, g.status, { error: g.error });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gafj/gafj",
-  "version": "0.1.19",
+  "version": "0.1.21",
   "description": "GAF-J: a local campaign engine for job search. One SQLite file, one ingest door, your own AI subscription.",
   "homepage": "https://gaf-j.com",
   "repository": {

package/store/setup.js

@@ -36,8 +36,10 @@ function setupView(db, homeDir, candidate_id) {
     { key: "discover", title: "Answer what's missing", done: questions > 0, detail: questions ? `${questions} question${questions === 1 ? "" : "s"} asked` : null },
     { key: "posting", title: "Paste your first job posting", done: postings > 0, detail: postings ? `${postings} posting${postings === 1 ? "" : "s"}` : null },
   ];
-  const next = steps.find((s) => !s.done);
-  return { steps, next: next ? next.key : null, complete: !next, dismissed: !!(cfg.setup && cfg.setup.dismissed), route: cfg.route || "paste" };
+  // a hosted account signed in to use the included AI; which AI is not a question there (Paste stays a Settings option)
+  const shown = cfg.hosted ? steps.filter((s) => s.key !== "ai") : steps;
+  const next = shown.find((s) => !s.done);
+  return { steps: shown, next: next ? next.key : null, complete: !next, dismissed: !!(cfg.setup && cfg.setup.dismissed), route: cfg.route || "paste" };
 }
 
 /** The user picked how they will use AI; the route is set and the step is done. */

package/ui/app.css

@@ -130,7 +130,10 @@ form.inline input, form.inline select { min-width: 120px; }
 table.cats { border-collapse: collapse; width: 100%; font-size: 13px; }
 table.cats th, table.cats td { border-bottom: 1px solid var(--line); padding: 6px; text-align: left; vertical-align: top; }
 table.cats th { font-family: var(--mono); font-size: 10.5px; text-transform: uppercase; letter-spacing: .05em; color: var(--muted); font-weight: 500; }
-table.cats input:not([type=checkbox]) { width: 100%; }
+table.cats input:not([type=checkbox]) { width: 100%; box-sizing: border-box; }
+table.cats td:first-child { min-width: 150px; }
+table.cats td:nth-child(2), table.cats td:nth-child(3) { width: 58px; }
+table.cats td:nth-child(5) { font-family: var(--sans); font-size: 12.5px; color: var(--muted); }
 input.narrow { width: 76px; }
 pre.wrap { white-space: pre-wrap; }
 /* KB "receipt" moment: the confirmed span highlighted inline against its muted source sentence. */

package/ui/hosted/signin.css

@@ -1,7 +1,6 @@
 .signin { max-width: 420px; margin: 10vh auto; padding: 32px 28px; background: var(--surface); border: 1px solid var(--line); border-radius: 12px; text-align: center; }
-.signin .mark { width: 64px; height: 64px; border-radius: 14px; margin-bottom: 12px; }
-.signin h1 { font-family: var(--mono); font-size: 20px; margin: 0 0 8px; }
-.signin .sub { color: var(--muted); font-size: 14px; line-height: 1.6; margin: 0 0 22px; text-align: left; }
+.signin .mark { width: 80px; height: 80px; border-radius: 18px; margin-bottom: 18px; }
+.signin .sub { color: var(--muted); font-family: var(--sans); font-size: 14px; line-height: 1.6; margin: 0 0 22px; text-align: left; }
 .signin button.primary { width: 100%; padding: 11px; font-size: 15px; }
 .signin details { text-align: left; margin-top: 22px; border-top: 1px solid var(--line); padding-top: 12px; }
 .signin textarea { min-height: 70px; font-size: 11px; }

package/ui/hosted/signin.html

@@ -10,8 +10,7 @@
 </head>
 <body>
 <main class="signin">
-  <img class="mark" src="/icon-192.png" alt="" width="64" height="64">
-  <h1>GAF-J</h1>
+  <img class="mark" src="/icon-192.png" alt="GAF-J" width="80" height="80">
   <p class="sub">Sign in with Google. Your record, documents, and campaign live in your account here, encrypted, yours to export or delete in one click.</p>
   <button id="google" class="primary" type="button">Continue with Google</button>
   <p id="status" class="small muted" hidden></p>

package/ui/lib.js

@@ -90,3 +90,38 @@ export function useInstall() {
   const standalone = matchMedia("(display-mode: standalone)").matches || navigator.standalone === true;
   return { canInstall: !!installer.event, installed: installer.installed || standalone, install: async () => { if (!installer.event) return; installer.event.prompt(); await installer.event.userChoice; installer.event = null; } };
 }
+
+/**
+ * A job posting as pasted: markdown links become their text, bare URLs and tracking lines go, blank runs
+ * collapse. A LinkedIn copy carries a wall of overlay URLs that says nothing about the job.
+ */
+export function cleanPosting(text) {
+  return String(text || "")
+    .replace(/!\[[^\]]*\]\([^)]*\)/g, "")
+    .replace(/\[([^\]]*)\]\((?:https?:)?\/\/[^)\s]*(?:\s+"[^"]*")?\)/g, "$1")
+    .replace(/\((?:https?:)?\/\/[^)\s]{20,}\)/g, "")
+    .split(/\r?\n/)
+    .map((l) => l.replace(/\s+$/, ""))
+    .filter((l, i, all) => !/^\s*(?:https?:)?\/\/\S+\s*$/.test(l) || (/\/(jobs?|careers?|positions?|openings?)\//i.test(l) && all.findIndex((x) => /^\s*(?:https?:)?\/\/\S+\s*$/.test(x) && /\/(jobs?|careers?|positions?|openings?)\//i.test(x)) === i))
+    .join("\n")
+    .replace(/[ \t]{3,}/g, "  ")
+    .replace(/\n{3,}/g, "\n\n")
+    .trim();
+}
+
+const NOISE = /\b(ago|hours?|days?|weeks?|applicants?|promoted|easy apply|reposted|save|share|show more|about the job|job details|united states|remote|hybrid|on-site|full-time|part-time|contract|tailor my resume|help me stand out|create cover letter)\b/i;
+const TITLE = /\b(director|manager|engineer|analyst|lead|head|vp|vice president|specialist|coordinator|supervisor|associate|consultant|architect|designer|developer|scientist|officer|president|chief|planner|buyer|controller|administrator|technician|representative|recruiter|nurse|teacher|intern|accountant|assistant|generalist|partner|strategist|writer|editor)\b/i;
+/** Title and company guessed from a posting's first lines; both are the person's to correct. */
+export function guessPosting(text) {
+  const lines = text.split(/\r?\n/).map((l) => l.trim()).filter(Boolean).slice(0, 20);
+  const plain = (l) => l.length <= 90 && !/^https?:/i.test(l) && !/^(at|company|location|posted|apply|share)\b/i.test(l) && !NOISE.test(l);
+  const title = lines.find((l) => plain(l) && TITLE.test(l) && !/[.:;]$/.test(l) && !/\b(company|inc|llc|corp|group|ltd)\.?$/i.test(l)) || lines.find(plain) || "";
+  let company = "";
+  for (const l of lines) { const m = l.match(/^(?:at|company[:\s]+|employer[:\s]+)\s*([^|·,]{2,60})/i); if (m) { company = m[1].trim(); break; } }
+  const i = lines.findIndex((l) => l === title);
+  const nameish = (l) => { const c = l.split(/\s[·|]\s/)[0].replace(/^[·|\-\s]+/, "").trim(); return c && c !== title && c.length <= 60 && !/^https?:/i.test(c) && !/\d{4}/.test(c) && !NOISE.test(c) && !/[.:;]$/.test(c) && c.split(/\s+/).length <= 8 ? c : ""; };
+  // the line after the title ("Company · City"), else a short name-like line above it, else one soon after
+  if (!company) company = [lines[i + 1] || ""].map(nameish).find(Boolean) || lines.slice(0, i).map(nameish).find(Boolean) || lines.slice(i + 2, i + 6).map(nameish).find(Boolean) || "";
+  const url = lines.find((l) => /^https?:\/\//i.test(l)) || "";
+  return { title, company, url };
+}

package/ui/screens/postings.js

@@ -1,5 +1,6 @@
 import { html, useState, useEffect } from "../vendor/preact.mjs";
-import { api } from "../lib.js";
+import { cleanPosting, guessPosting, api } from "../lib.js";
+import { PacketModal } from "./packet.js";
 
 /** Screen 2: paste a posting, store and scan locally, edit the proposed categories, freeze, log the application. */
 
@@ -39,25 +40,29 @@ export function Postings({ live, id }) {
   const [form, setForm] = useState({ company: "", title: "", source_url: "", location: "", comp_text: "", raw_text: "" });
   const [guessed, setGuessed] = useState({ company: true, title: true });
   // the paste is all a person should have to give; company and title are guessed from its first lines and can be corrected
-  const onPaste = (text) => {
-    const lines = text.split(/\r?\n/).map((l) => l.trim()).filter(Boolean).slice(0, 12);
+  const onPaste = (raw) => {
+    const text = cleanPosting(raw);
+    const g = guessPosting(text);
     const next = { ...form, raw_text: text };
-    if (guessed.title) {
-      const t = lines.find((l) => l.length <= 90 && !/^https?:/i.test(l) && !/^(at|company|location|posted|apply|share)\b/i.test(l));
-      next.title = t || "";
-    }
-    if (guessed.company) {
-      let c = "";
-      for (const l of lines) { const m = l.match(/^(?:at|company[:\s]+|employer[:\s]+)\s*([^|·,]{2,60})/i); if (m) { c = m[1].trim(); break; } }
-      if (!c) { const i = lines.findIndex((l) => l === next.title); const cand = lines[i + 1] || ""; if (cand && cand.length <= 50 && !/^https?:/i.test(cand) && !/\d{4}/.test(cand)) c = cand.replace(/^[·|\-\s]+/, ""); }
-      next.company = c;
-    }
-    const url = lines.find((l) => /^https?:\/\//i.test(l));
-    if (url && !form.source_url) next.source_url = url;
+    if (guessed.title) next.title = g.title;
+    if (guessed.company) next.company = g.company;
+    if (g.url && !form.source_url) next.source_url = g.url;
     setForm(next);
   };
   const [err, setErr] = useState("");
   const [msg, setMsg] = useState("");
+  const [me, setMe] = useState(null);
+  const [modal, setModal] = useState(null);
+  const [asking, setAsking] = useState(false);
+  useEffect(() => { api.get("/api/me").then(setMe).catch(() => {}); }, []);
+  const direct = me && (me.route === "byo_key" || me.route === "credits");
+  // the AI reads the posting and proposes the five to eight things the employer is really asking for, each with its verbatim line
+  const askAi = async (posting_id) => {
+    if (!direct) { setModal({ op: "categories", posting_id }); return; }
+    setAsking(true); setErr(""); setMsg("");
+    try { const r = await api.post(`/api/run/categories?posting_id=${encodeURIComponent(posting_id)}`, {}); if (r.status !== "passed") setErr("refused: " + (r.errors || []).join("; ")); else setMsg("your AI proposed the categories; edit and freeze below"); await load(); } catch (e) { setErr(e.message); }
+    setAsking(false);
+  };
   const load = async () => { setRows(await api.get("/api/postings")); if (id) setSel(await api.get(`/api/postings/${id}`)); };
   useEffect(() => { load().catch((e) => setErr(e.message)); }, [live, id]);
   const store = async (e) => {
@@ -95,7 +100,9 @@ export function Postings({ live, id }) {
             <div class="row"><span class="tag">${sel.status}</span><span class="muted small">${[sel.location, sel.comp_text].filter(Boolean).join(" · ")}</span>
               ${sel.status === "proposed" ? html`<button class="primary" onClick=${() => act(`/api/postings/${sel.posting_id}/accept`)}>Accept</button>` : ""}
               ${sel.status === "proposed" ? html`<button onClick=${() => act(`/api/postings/${sel.posting_id}/archive`)}>Archive</button>` : ""}
+              <button class="primary" disabled=${asking} onClick=${() => askAi(sel.posting_id)}>${asking ? "asking" : "Ask your AI for categories"}</button>
               <button onClick=${() => act(`/api/postings/${sel.posting_id}/scan`)}>Scan again</button></div>
+            ${modal ? html`<${PacketModal} op="categories" label="Categories" target=${{ posting_id: modal.posting_id }} onClose=${() => setModal(null)} onSaved=${load} />` : ""}
             <details><summary>raw text (${sel.raw_text.length} chars)</summary><pre class="mono wrap">${sel.raw_text}</pre></details>
           </div>
           ${frozen ? html`<div class="card"><b>fit ${frozen.fit_score} · ${frozen.verdict.toUpperCase()}</b> <span class="muted small">${frozen.verdict_reason}</span>
@@ -103,7 +110,7 @@ export function Postings({ live, id }) {
             ${!rows.find((r) => r.posting_id === sel.posting_id && r.application_id) && sel.status === "accepted" ? html`<div class="row"><button class="primary" onClick=${async () => { const r = await act("/api/applications", { posting_id: sel.posting_id }); if (r) location.hash = "#/applications/" + r.application_id; }}>Log application</button></div>` : ""}
           </div>` : ""}
           <h3>${frozen ? "Re-score" : "Proposed categories"} ${proposed ? html`<span class="tag">draft from ${proposed.scored_at.slice(0, 10)}</span>` : ""}</h3>
-          ${proposed || frozen ? html`<div class="card"><${CategoryEditor} key=${(proposed || frozen).scoring_id} posting=${sel} scoring=${proposed || frozen} onDone=${load} /></div>` : html`<p class="muted">no categories yet; scan the posting or let a model propose them through MCP</p>`}
+          ${proposed || frozen ? html`<div class="card">${proposed && !frozen ? html`<p class="small muted">${direct ? "A quick local scan made this draft. \"Ask your AI for categories\" above replaces it with a read of the whole posting." : "A quick local scan made this draft; your AI can do better through the button above."}</p>` : ""}<${CategoryEditor} key=${(proposed || frozen).scoring_id} posting=${sel} scoring=${proposed || frozen} onDone=${load} /></div>` : html`<p class="muted">no categories yet; ask your AI above, or scan the posting</p>`}
           ${sel.gaps.length ? html`<h3>KB gaps (${sel.gaps.length})</h3><ul class="list">${sel.gaps.map((g) => html`<li key=${g.gap_id}>${g.question} <span class="small muted">"${g.requirement_text}"</span> ${g.resolved_at ? html`<span class="tag passed">answered</span>` : html`<a class="small" href="#/kb">answer</a>`}</li>`)}</ul>` : ""}
         ` : html`<p class="muted">pick a posting</p>`}
       </div>

package/ui/screens/welcome.js

@@ -1,5 +1,5 @@
 import { html, useState, useEffect } from "../vendor/preact.mjs";
-import { api } from "../lib.js";
+import { api, cleanPosting, guessPosting } from "../lib.js";
 import { Onboarding, DraftForm, fromDraft, Positions, ContactForm } from "./kb.js";
 import { PacketModal } from "./packet.js";
 
@@ -58,29 +58,36 @@ function StepAi({ s, reload, hosted }) {
   </div>`;
 }
 
-function StepPosting({ reload }) {
+function StepPosting({ reload, direct }) {
   const [text, setText] = useState("");
   const [company, setCompany] = useState("");
   const [title, setTitle] = useState("");
   const [g, setG] = useState({ company: true, title: true });
   const [err, setErr] = useState("");
-  const onPaste = (t) => {
+  const [busy, setBusy] = useState(false);
+  const onPaste = (raw) => {
+    const t = cleanPosting(raw);
     setText(t);
-    const lines = t.split(/\r?\n/).map((l) => l.trim()).filter(Boolean).slice(0, 12);
-    let ti = title, co = company;
-    if (g.title) ti = lines.find((l) => l.length <= 90 && !/^https?:/i.test(l) && !/^(at|company|location|posted|apply|share)\b/i.test(l)) || "";
-    if (g.company) { co = ""; for (const l of lines) { const m = l.match(/^(?:at|company[:\s]+|employer[:\s]+)\s*([^|·,]{2,60})/i); if (m) { co = m[1].trim(); break; } } if (!co) { const i = lines.findIndex((l) => l === ti); const c = lines[i + 1] || ""; if (c && c.length <= 50 && !/^https?:/i.test(c) && !/\d{4}/.test(c)) co = c.replace(/^[·|\-\s]+/, ""); } }
-    setTitle(ti); setCompany(co);
+    const gu = guessPosting(t);
+    if (g.title) setTitle(gu.title);
+    if (g.company) setCompany(gu.company);
   };
   const store = async (e) => {
     e.preventDefault(); setErr("");
-    try { const r = await api.post("/api/postings", { company, title, raw_text: text }); await api.post(`/api/postings/${r.posting_id}/scan`, {}); await reload(); } catch (e2) { setErr(e2.message); }
+    setBusy(true);
+    try {
+      const r = await api.post("/api/postings", { company, title, raw_text: text });
+      await api.post(`/api/postings/${r.posting_id}/scan`, {});
+      if (direct) { try { await api.post(`/api/run/categories?posting_id=${encodeURIComponent(r.posting_id)}`, {}); } catch (e3) { /* the local scan's draft stands; the posting page can ask again */ } }
+      await reload();
+    } catch (e2) { setErr(e2.message); }
+    setBusy(false);
   };
   return html`<form onSubmit=${store}>
     <p>Paste the text of a job you want, exactly as the site shows it. GAF-J scores it against your record and shows what the posting asks for beside what you have. Everything else (the resume, the prep) starts from there.</p>
     <textarea required placeholder="the whole posting" value=${text} onInput=${(e) => onPaste(e.target.value)}></textarea>
     <div class="row"><input required placeholder="company (guessed; fix if wrong)" value=${company} onInput=${(e) => { setG({ ...g, company: false }); setCompany(e.target.value); }} /><input required placeholder="title (guessed; fix if wrong)" value=${title} onInput=${(e) => { setG({ ...g, title: false }); setTitle(e.target.value); }} /></div>
-    <div class="row"><button class="primary">Store and score</button>${err ? html`<span class="error small">${err}</span>` : ""}</div>
+    <div class="row"><button class="primary" disabled=${busy}>${busy ? (direct ? "storing, then asking your AI what it wants" : "storing") : "Store and score"}</button>${err ? html`<span class="error small">${err}</span>` : ""}</div>
   </form>`;
 }
 
@@ -124,10 +131,10 @@ export function Welcome({ live, onDone }) {
       ${kb.questions.length ? html`<ul class="list">${kb.questions.map((q) => html`<li key=${q.question_id}><div><span class="tag">${q.kind}</span> <b>${q.title}</b> <span class="muted">${q.company}</span><br />${q.question}
         ${answering === q.question_id ? html`<${DraftForm} label="Add answer" initial=${fromDraft(q.draft)} onSubmit=${(draft) => { post(`/api/kb/questions/${q.question_id}/answer`, { draft }); setAnswering(null); }} />` : html`<div class="row"><button class="small" onClick=${() => setAnswering(q.question_id)}>Answer</button><button class="small danger" onClick=${() => post(`/api/kb/questions/${q.question_id}/dismiss`, {})}>Skip</button></div>`}</div></li>`)}</ul>`
         : html`<div class="row"><button class="primary" disabled=${!!busy} onClick=${discover}>${busy ? "asking" : "Ask what's missing"}</button><button onClick=${() => post("/api/setup/dismiss", { dismissed: true })}>Later</button></div>`}</div>`,
-    posting: html`<${StepPosting} reload=${load} />`,
+    posting: html`<${StepPosting} reload=${load} direct=${direct} />`,
   };
   return html`<div class="welcome">
-    <div class="welcome-head"><img src="/icon-192.png" alt="" width="40" height="40" /><div><b>Welcome to GAF-J${me.name ? ", " + me.name : ""}</b><div class="small muted">Seven short steps, then the app is yours.</div></div>
+    <div class="welcome-head"><img src="/icon-192.png" alt="" width="40" height="40" /><div><b>Welcome to GAF-J${me.name ? ", " + me.name : ""}</b><div class="small muted">${["", "One", "Two", "Three", "Four", "Five", "Six", "Seven", "Eight"][setup.steps.length] || setup.steps.length} short steps, then the app is yours.</div></div>
       <span class="links"><a class="small" href="#/settings">Settings</a><a class="small" href="#/" onClick=${async (e) => { e.preventDefault(); await api.post("/api/setup/dismiss", {}); onDone(); }}>skip for now</a></span></div>
     <ol class="stepper">${setup.steps.map((st, i) => html`<li key=${st.key} class=${(st.done ? "done" : "") + (i === idx ? " now" : "") + (i <= nextIdx ? " can" : "")} onClick=${() => { if (i <= nextIdx) setView(i); }} title=${i <= nextIdx ? "open this step" : ""}><span class="n mono">${st.done ? "✓" : i + 1}</span>${st.title}</li>`)}</ol>
     ${err ? html`<p class="error">${err}</p>` : ""}