@gafj/gafj 0.1.20 → 0.1.21

package/bin/cli.js

@@ -321,6 +321,7 @@ async function main(argv) {
     const { createHostedServer } = require("../http/hosted");
     const { firebaseVerifier } = require("../http/identity");
     const { Log } = require("../store/log");
+    const pkg = require("../package.json");
     const env = process.env;
     const root = env.GAFJ_HOSTED_ROOT || "/data";
     if (!env.GAFJ_FIREBASE_PROJECT_ID) { process.stderr.write("serve-hosted needs GAFJ_FIREBASE_PROJECT_ID (and GAFJ_FIREBASE_API_KEY, GAFJ_FIREBASE_AUTH_DOMAIN for the sign-in page)\n"); process.exit(2); }

package/core/scoring.js

@@ -128,8 +128,10 @@ function conceptTags(requirementText) {
   return hit;
 }
 
+/** Lines a job board adds around a posting; never a requirement of the job. */
+const BOARD_NOISE = /\b(your profile and resume match|see how you compare|applicants?\b.*\b(ago|clicked)|easy apply|promoted by|reposted|set alert for similar|show more|show less|tailor my resume|help me stand out|create cover letter|people you can reach out to|meet the hiring team|skills you have|sign in to|referrals increase)\b/i;
 function lines(text) {
-  return String(text).split(/\r?\n|(?<=[.;])\s{2,}/).map((l) => l.trim()).filter(Boolean);
+  return String(text).split(/\r?\n|(?<=[.;])\s{2,}/).map((l) => l.trim()).filter((l) => l && !BOARD_NOISE.test(l));
 }
 
 /** Every figure in a document: money, percents, counts, durations. */

package/http/hosted.js

@@ -34,8 +34,34 @@ const { UI_DIR } = require("./server");
 const COOKIE = "gafj_hs";
 const SESSION_TTL_MS = 30 * 24 * 3600 * 1000;
 const IDLE_CLOSE_MS = 10 * 60 * 1000;
-const SIGNIN_CSP = "default-src 'self'; script-src 'self' https://www.gstatic.com https://apis.google.com; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self' https://identitytoolkit.googleapis.com https://securetoken.googleapis.com https://www.googleapis.com https://apis.google.com; frame-src https://*.firebaseapp.com https://accounts.google.com; frame-ancestors 'none'; base-uri 'none'; form-action 'self'; object-src 'none'";
+const SIGNIN_CSP = "default-src 'self'; script-src 'self' https://www.gstatic.com https://apis.google.com; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self' https://identitytoolkit.googleapis.com https://securetoken.googleapis.com https://www.googleapis.com https://apis.google.com; frame-src 'self' https://*.firebaseapp.com https://accounts.google.com; frame-ancestors 'none'; base-uri 'none'; form-action 'self'; object-src 'none'";
 const MIME = { ".html": "text/html; charset=utf-8", ".js": "text/javascript; charset=utf-8", ".mjs": "text/javascript; charset=utf-8", ".css": "text/css; charset=utf-8", ".json": "application/json; charset=utf-8", ".svg": "image/svg+xml", ".png": "image/png", ".webmanifest": "application/manifest+json", ".ico": "image/x-icon", ".woff2": "font/woff2" };
+/**
+ * Google sign-in's handler pages live on <project>.firebaseapp.com. Served from another site, the
+ * popup and redirect flows depend on third-party storage that browsers now block, so the app
+ * serves them itself: everything under /__/ is fetched from Firebase and passed through, and the
+ * sign-in page uses this host as its auth domain. Firebase's own headers come back with the page;
+ * only hop-by-hop and cookie headers are dropped.
+ */
+const PASS_REQ = new Set(["accept", "accept-language", "content-type", "content-length", "referer", "user-agent", "x-requested-with", "origin"]);
+const DROP_RES = new Set(["set-cookie", "transfer-encoding", "connection", "keep-alive", "content-encoding", "content-length", "strict-transport-security", "alt-svc"]);
+async function proxyAuth(req, res, { projectId, fetchImpl, originOf }) {
+  const upstream = `https://${projectId}.firebaseapp.com${req.url}`;
+  const headers = {};
+  for (const [k, v] of Object.entries(req.headers)) if (PASS_REQ.has(k)) headers[k] = v;
+  if (headers.origin) headers.origin = `https://${projectId}.firebaseapp.com`;
+  if (headers.referer) headers.referer = headers.referer.replace(originOf, `https://${projectId}.firebaseapp.com`);
+  headers["accept-encoding"] = "identity";
+  const body = req.method === "GET" || req.method === "HEAD" ? undefined : await new Promise((resolve, reject) => { const c = []; req.on("data", (d) => c.push(d)); req.on("end", () => resolve(Buffer.concat(c))); req.on("error", reject); });
+  const r = await fetchImpl(upstream, { method: req.method, headers, body, redirect: "manual" });
+  const out = {};
+  for (const [k, v] of r.headers.entries()) if (!DROP_RES.has(k.toLowerCase())) out[k] = v;
+  const buf = Buffer.from(await r.arrayBuffer());
+  out["content-length"] = String(buf.length);
+  res.writeHead(r.status, out);
+  return res.end(buf);
+}
+
 const BLOCKED_IN_HOSTED = [/^\/api\/settings\/providers/, /^\/api\/mcp-config$/, /^\/api\/restore-test$/];
 
 function json(res, status, body) {
@@ -157,7 +183,9 @@ function createHostedServer(o) {
     res.on("finish", () => log.write(res.statusCode >= 500 ? "error" : res.statusCode >= 400 ? "warn" : "info", "request",
       { entity: "http", entity_id: `${req.method} ${p}`, actor: who ? "user" : "anon", ms: Date.now() - started, status: res.statusCode }));
     try {
+      if (p === "/healthz" && req.method === "GET") return json(res, 200, { ok: true, version: o.version }); // the platform's check arrives under its own host name
       if (host && String(req.headers.host || "").toLowerCase() !== host) return json(res, 421, { error: "wrong host" });
+      if (p.startsWith("/__/") && o.firebase && o.firebase.projectId) return proxyAuth(req, res, { projectId: o.firebase.projectId, fetchImpl: o.fetch || fetch, originOf: originOf(req) });
       const mutation = req.method !== "GET" && req.method !== "HEAD";
       securityHeaders(res, { noStore: isApi || p.startsWith("/auth/") || p.startsWith("/account/") });
 
@@ -166,7 +194,8 @@ function createHostedServer(o) {
         res.writeHead(200, { "Content-Type": MIME[".html"], "Cache-Control": "no-cache" });
         return fs.createReadStream(path.join(UI_DIR, "hosted", "signin.html")).pipe(res);
       }
-      if (p === "/signin/config.json") return json(res, 200, { firebase: o.firebase || null, signed_in: !!sessionOf(req) });
+      // the auth domain is this host, so Google's handler pages come through the proxy above and stay same-site
+      if (p === "/signin/config.json") return json(res, 200, { firebase: o.firebase ? { ...o.firebase, authDomain: String(req.headers.host || o.firebase.authDomain || "").toLowerCase() } : null, signed_in: !!sessionOf(req) });
       if (p === "/auth/session" && req.method === "POST") {
         const g = mutationCheck(req);
         if (g) return json(res, g.status, { error: g.error });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gafj/gafj",
-  "version": "0.1.20",
+  "version": "0.1.21",
   "description": "GAF-J: a local campaign engine for job search. One SQLite file, one ingest door, your own AI subscription.",
   "homepage": "https://gaf-j.com",
   "repository": {

package/store/setup.js

@@ -36,8 +36,10 @@ function setupView(db, homeDir, candidate_id) {
     { key: "discover", title: "Answer what's missing", done: questions > 0, detail: questions ? `${questions} question${questions === 1 ? "" : "s"} asked` : null },
     { key: "posting", title: "Paste your first job posting", done: postings > 0, detail: postings ? `${postings} posting${postings === 1 ? "" : "s"}` : null },
   ];
-  const next = steps.find((s) => !s.done);
-  return { steps, next: next ? next.key : null, complete: !next, dismissed: !!(cfg.setup && cfg.setup.dismissed), route: cfg.route || "paste" };
+  // a hosted account signed in to use the included AI; which AI is not a question there (Paste stays a Settings option)
+  const shown = cfg.hosted ? steps.filter((s) => s.key !== "ai") : steps;
+  const next = shown.find((s) => !s.done);
+  return { steps: shown, next: next ? next.key : null, complete: !next, dismissed: !!(cfg.setup && cfg.setup.dismissed), route: cfg.route || "paste" };
 }
 
 /** The user picked how they will use AI; the route is set and the step is done. */

package/ui/app.css

@@ -130,7 +130,10 @@ form.inline input, form.inline select { min-width: 120px; }
 table.cats { border-collapse: collapse; width: 100%; font-size: 13px; }
 table.cats th, table.cats td { border-bottom: 1px solid var(--line); padding: 6px; text-align: left; vertical-align: top; }
 table.cats th { font-family: var(--mono); font-size: 10.5px; text-transform: uppercase; letter-spacing: .05em; color: var(--muted); font-weight: 500; }
-table.cats input:not([type=checkbox]) { width: 100%; }
+table.cats input:not([type=checkbox]) { width: 100%; box-sizing: border-box; }
+table.cats td:first-child { min-width: 150px; }
+table.cats td:nth-child(2), table.cats td:nth-child(3) { width: 58px; }
+table.cats td:nth-child(5) { font-family: var(--sans); font-size: 12.5px; color: var(--muted); }
 input.narrow { width: 76px; }
 pre.wrap { white-space: pre-wrap; }
 /* KB "receipt" moment: the confirmed span highlighted inline against its muted source sentence. */

package/ui/hosted/signin.css

@@ -1,7 +1,6 @@
 .signin { max-width: 420px; margin: 10vh auto; padding: 32px 28px; background: var(--surface); border: 1px solid var(--line); border-radius: 12px; text-align: center; }
-.signin .mark { width: 64px; height: 64px; border-radius: 14px; margin-bottom: 12px; }
-.signin h1 { font-family: var(--mono); font-size: 20px; margin: 0 0 8px; }
-.signin .sub { color: var(--muted); font-size: 14px; line-height: 1.6; margin: 0 0 22px; text-align: left; }
+.signin .mark { width: 80px; height: 80px; border-radius: 18px; margin-bottom: 18px; }
+.signin .sub { color: var(--muted); font-family: var(--sans); font-size: 14px; line-height: 1.6; margin: 0 0 22px; text-align: left; }
 .signin button.primary { width: 100%; padding: 11px; font-size: 15px; }
 .signin details { text-align: left; margin-top: 22px; border-top: 1px solid var(--line); padding-top: 12px; }
 .signin textarea { min-height: 70px; font-size: 11px; }

package/ui/hosted/signin.html

@@ -10,8 +10,7 @@
 </head>
 <body>
 <main class="signin">
-  <img class="mark" src="/icon-192.png" alt="" width="64" height="64">
-  <h1>GAF-J</h1>
+  <img class="mark" src="/icon-192.png" alt="GAF-J" width="80" height="80">
   <p class="sub">Sign in with Google. Your record, documents, and campaign live in your account here, encrypted, yours to export or delete in one click.</p>
   <button id="google" class="primary" type="button">Continue with Google</button>
   <p id="status" class="small muted" hidden></p>

package/ui/screens/postings.js

@@ -1,5 +1,6 @@
 import { html, useState, useEffect } from "../vendor/preact.mjs";
 import { cleanPosting, guessPosting, api } from "../lib.js";
+import { PacketModal } from "./packet.js";
 
 /** Screen 2: paste a posting, store and scan locally, edit the proposed categories, freeze, log the application. */
 
@@ -50,6 +51,18 @@ export function Postings({ live, id }) {
   };
   const [err, setErr] = useState("");
   const [msg, setMsg] = useState("");
+  const [me, setMe] = useState(null);
+  const [modal, setModal] = useState(null);
+  const [asking, setAsking] = useState(false);
+  useEffect(() => { api.get("/api/me").then(setMe).catch(() => {}); }, []);
+  const direct = me && (me.route === "byo_key" || me.route === "credits");
+  // the AI reads the posting and proposes the five to eight things the employer is really asking for, each with its verbatim line
+  const askAi = async (posting_id) => {
+    if (!direct) { setModal({ op: "categories", posting_id }); return; }
+    setAsking(true); setErr(""); setMsg("");
+    try { const r = await api.post(`/api/run/categories?posting_id=${encodeURIComponent(posting_id)}`, {}); if (r.status !== "passed") setErr("refused: " + (r.errors || []).join("; ")); else setMsg("your AI proposed the categories; edit and freeze below"); await load(); } catch (e) { setErr(e.message); }
+    setAsking(false);
+  };
   const load = async () => { setRows(await api.get("/api/postings")); if (id) setSel(await api.get(`/api/postings/${id}`)); };
   useEffect(() => { load().catch((e) => setErr(e.message)); }, [live, id]);
   const store = async (e) => {
@@ -87,7 +100,9 @@ export function Postings({ live, id }) {
             <div class="row"><span class="tag">${sel.status}</span><span class="muted small">${[sel.location, sel.comp_text].filter(Boolean).join(" · ")}</span>
               ${sel.status === "proposed" ? html`<button class="primary" onClick=${() => act(`/api/postings/${sel.posting_id}/accept`)}>Accept</button>` : ""}
               ${sel.status === "proposed" ? html`<button onClick=${() => act(`/api/postings/${sel.posting_id}/archive`)}>Archive</button>` : ""}
+              <button class="primary" disabled=${asking} onClick=${() => askAi(sel.posting_id)}>${asking ? "asking" : "Ask your AI for categories"}</button>
               <button onClick=${() => act(`/api/postings/${sel.posting_id}/scan`)}>Scan again</button></div>
+            ${modal ? html`<${PacketModal} op="categories" label="Categories" target=${{ posting_id: modal.posting_id }} onClose=${() => setModal(null)} onSaved=${load} />` : ""}
             <details><summary>raw text (${sel.raw_text.length} chars)</summary><pre class="mono wrap">${sel.raw_text}</pre></details>
           </div>
           ${frozen ? html`<div class="card"><b>fit ${frozen.fit_score} · ${frozen.verdict.toUpperCase()}</b> <span class="muted small">${frozen.verdict_reason}</span>
@@ -95,7 +110,7 @@ export function Postings({ live, id }) {
             ${!rows.find((r) => r.posting_id === sel.posting_id && r.application_id) && sel.status === "accepted" ? html`<div class="row"><button class="primary" onClick=${async () => { const r = await act("/api/applications", { posting_id: sel.posting_id }); if (r) location.hash = "#/applications/" + r.application_id; }}>Log application</button></div>` : ""}
           </div>` : ""}
           <h3>${frozen ? "Re-score" : "Proposed categories"} ${proposed ? html`<span class="tag">draft from ${proposed.scored_at.slice(0, 10)}</span>` : ""}</h3>
-          ${proposed || frozen ? html`<div class="card"><${CategoryEditor} key=${(proposed || frozen).scoring_id} posting=${sel} scoring=${proposed || frozen} onDone=${load} /></div>` : html`<p class="muted">no categories yet; scan the posting or let a model propose them through MCP</p>`}
+          ${proposed || frozen ? html`<div class="card">${proposed && !frozen ? html`<p class="small muted">${direct ? "A quick local scan made this draft. \"Ask your AI for categories\" above replaces it with a read of the whole posting." : "A quick local scan made this draft; your AI can do better through the button above."}</p>` : ""}<${CategoryEditor} key=${(proposed || frozen).scoring_id} posting=${sel} scoring=${proposed || frozen} onDone=${load} /></div>` : html`<p class="muted">no categories yet; ask your AI above, or scan the posting</p>`}
           ${sel.gaps.length ? html`<h3>KB gaps (${sel.gaps.length})</h3><ul class="list">${sel.gaps.map((g) => html`<li key=${g.gap_id}>${g.question} <span class="small muted">"${g.requirement_text}"</span> ${g.resolved_at ? html`<span class="tag passed">answered</span>` : html`<a class="small" href="#/kb">answer</a>`}</li>`)}</ul>` : ""}
         ` : html`<p class="muted">pick a posting</p>`}
       </div>

package/ui/screens/welcome.js

@@ -58,12 +58,13 @@ function StepAi({ s, reload, hosted }) {
   </div>`;
 }
 
-function StepPosting({ reload }) {
+function StepPosting({ reload, direct }) {
   const [text, setText] = useState("");
   const [company, setCompany] = useState("");
   const [title, setTitle] = useState("");
   const [g, setG] = useState({ company: true, title: true });
   const [err, setErr] = useState("");
+  const [busy, setBusy] = useState(false);
   const onPaste = (raw) => {
     const t = cleanPosting(raw);
     setText(t);
@@ -73,13 +74,20 @@ function StepPosting({ reload }) {
   };
   const store = async (e) => {
     e.preventDefault(); setErr("");
-    try { const r = await api.post("/api/postings", { company, title, raw_text: text }); await api.post(`/api/postings/${r.posting_id}/scan`, {}); await reload(); } catch (e2) { setErr(e2.message); }
+    setBusy(true);
+    try {
+      const r = await api.post("/api/postings", { company, title, raw_text: text });
+      await api.post(`/api/postings/${r.posting_id}/scan`, {});
+      if (direct) { try { await api.post(`/api/run/categories?posting_id=${encodeURIComponent(r.posting_id)}`, {}); } catch (e3) { /* the local scan's draft stands; the posting page can ask again */ } }
+      await reload();
+    } catch (e2) { setErr(e2.message); }
+    setBusy(false);
   };
   return html`<form onSubmit=${store}>
     <p>Paste the text of a job you want, exactly as the site shows it. GAF-J scores it against your record and shows what the posting asks for beside what you have. Everything else (the resume, the prep) starts from there.</p>
     <textarea required placeholder="the whole posting" value=${text} onInput=${(e) => onPaste(e.target.value)}></textarea>
     <div class="row"><input required placeholder="company (guessed; fix if wrong)" value=${company} onInput=${(e) => { setG({ ...g, company: false }); setCompany(e.target.value); }} /><input required placeholder="title (guessed; fix if wrong)" value=${title} onInput=${(e) => { setG({ ...g, title: false }); setTitle(e.target.value); }} /></div>
-    <div class="row"><button class="primary">Store and score</button>${err ? html`<span class="error small">${err}</span>` : ""}</div>
+    <div class="row"><button class="primary" disabled=${busy}>${busy ? (direct ? "storing, then asking your AI what it wants" : "storing") : "Store and score"}</button>${err ? html`<span class="error small">${err}</span>` : ""}</div>
   </form>`;
 }
 
@@ -123,10 +131,10 @@ export function Welcome({ live, onDone }) {
       ${kb.questions.length ? html`<ul class="list">${kb.questions.map((q) => html`<li key=${q.question_id}><div><span class="tag">${q.kind}</span> <b>${q.title}</b> <span class="muted">${q.company}</span><br />${q.question}
         ${answering === q.question_id ? html`<${DraftForm} label="Add answer" initial=${fromDraft(q.draft)} onSubmit=${(draft) => { post(`/api/kb/questions/${q.question_id}/answer`, { draft }); setAnswering(null); }} />` : html`<div class="row"><button class="small" onClick=${() => setAnswering(q.question_id)}>Answer</button><button class="small danger" onClick=${() => post(`/api/kb/questions/${q.question_id}/dismiss`, {})}>Skip</button></div>`}</div></li>`)}</ul>`
         : html`<div class="row"><button class="primary" disabled=${!!busy} onClick=${discover}>${busy ? "asking" : "Ask what's missing"}</button><button onClick=${() => post("/api/setup/dismiss", { dismissed: true })}>Later</button></div>`}</div>`,
-    posting: html`<${StepPosting} reload=${load} />`,
+    posting: html`<${StepPosting} reload=${load} direct=${direct} />`,
   };
   return html`<div class="welcome">
-    <div class="welcome-head"><img src="/icon-192.png" alt="" width="40" height="40" /><div><b>Welcome to GAF-J${me.name ? ", " + me.name : ""}</b><div class="small muted">Seven short steps, then the app is yours.</div></div>
+    <div class="welcome-head"><img src="/icon-192.png" alt="" width="40" height="40" /><div><b>Welcome to GAF-J${me.name ? ", " + me.name : ""}</b><div class="small muted">${["", "One", "Two", "Three", "Four", "Five", "Six", "Seven", "Eight"][setup.steps.length] || setup.steps.length} short steps, then the app is yours.</div></div>
       <span class="links"><a class="small" href="#/settings">Settings</a><a class="small" href="#/" onClick=${async (e) => { e.preventDefault(); await api.post("/api/setup/dismiss", {}); onDone(); }}>skip for now</a></span></div>
     <ol class="stepper">${setup.steps.map((st, i) => html`<li key=${st.key} class=${(st.done ? "done" : "") + (i === idx ? " now" : "") + (i <= nextIdx ? " can" : "")} onClick=${() => { if (i <= nextIdx) setView(i); }} title=${i <= nextIdx ? "open this step" : ""}><span class="n mono">${st.done ? "✓" : i + 1}</span>${st.title}</li>`)}</ol>
     ${err ? html`<p class="error">${err}</p>` : ""}