@proagentstore/cli 0.4.88 → 0.4.89

package/dist/browser-runner/local-apply/bridge.js

@@ -25,6 +25,7 @@
  * The trace carries classes, domains, decisions and artifact handles — never a typed value.
  */
 import { classifyApplyClick } from "./contract.js";
+import { CONFIRMATION_INTERVAL_SECONDS, CONFIRMATION_LOOKS, CONFIRMATION_TEXT_RE, confirmationMarker, observe, } from "./confirmation.js";
 import { ELEMENT_PROBE_FN } from "../commit-guard.js";
 import { normalize } from "../local-artifact/engine.js";
 import { evaluateResult, hostOf, refRole } from "../local-browser/bridge.js";
@@ -58,8 +59,15 @@ const CONSENT_NAME = /\b(agree|consent|terms|privacy|acknowledge|certify|accept|
 const CREDENTIAL_NAME = /password|passcode|one[- ]?time|\botp\b|verification code|security code|2fa|two[- ]factor/i;
 /** Keys that move between fields without entering or activating anything. */
 const SAFE_KEYS = /^(Tab|Shift\+Tab|Arrow(Up|Down|Left|Right)|Escape|Home|End|PageUp|PageDown)$/;
-/** Runs inside the page, through the browser's own evaluate tool — never offered to the CLI. */
+/**
+ * Runs inside the page, through the browser's own evaluate tool — never offered to the CLI.
+ *
+ * The success vocabulary is INTERPOLATED from `confirmation.ts` rather than written out here
+ * (#994): a second copy of that regex is how the "sent" family — the exact word SEEK uses — was
+ * missing from the detector while being present in nobody's tests, through three live runs.
+ */
 const INSPECT_PAGE = `() => {
+	const CONFIRMATION_TEXT_SOURCE = ${JSON.stringify(CONFIRMATION_TEXT_RE.source)};
 	const text = (document.body ? document.body.innerText : "").slice(0, 20000).toLowerCase();
 	const has = (s) => !!document.querySelector(s);
 	return {
@@ -70,7 +78,7 @@ const INSPECT_PAGE = `() => {
 		login: has('input[type=password]'),
 		duplicate: /you('ve| have) already applied|already applied (for|to) this|application (already exists|has already been (submitted|received))|duplicate application/.test(text),
 		antiBot: /unusual traffic|access (is )?denied|request (has been )?blocked|bot detected|checking (if the site connection is secure|your browser)/.test(text),
-		confirmed: /thank you for (your )?appl|application (has been |was )?(received|submitted)|we('ve| have) received your application|successfully (applied|submitted)/.test(text),
+		confirmed: new RegExp(CONFIRMATION_TEXT_SOURCE).test(text),
 		unavailable: /(?:this |the )?(?:job|position|posting|role|opportunity).{0,120}(?:has )?(?:expired|closed|been filled|is no longer available|is no longer accepting applications)|(?:expired|closed|no longer available|no longer accepting applications).{0,120}(?:job|position|posting|role|opportunity)/.test(text)
 			? (/expired/.test(text) ? "expired" : "unavailable")
 			: null,
@@ -120,6 +128,8 @@ export class ApplyBridge {
     /** Present only after the CLI explicitly reports a notice that the runner independently saw. */
     unavailable = null;
     submitAttempted = false;
+    /** What was seen after the submit click (#994) — read by the runtime to build the diagnostic. */
+    confirmation = null;
     submitted = null;
     /** The last thing that stopped the work and was not resolved — the block reason if the run ends here. */
     blocked = null;
@@ -609,17 +619,44 @@ export class ApplyBridge {
         this.submitAttempted = true;
         this.host.emit({ type: "submit.attempted", url: before.url, domain, detail: { class: "submit", gateId: this.host.gateId } });
         const res = await this.browser.callTool("browser_click", forward);
-        await this.browser.callTool("browser_wait_for", { time: 2 }).catch(() => undefined);
-        const after = res.isError ? null : await this.inspect();
-        if (after?.confirmed) {
-            this.submitted = { url: after.url, at: new Date(this.host.now()).toISOString(), gateId: this.host.gateId };
-            this.host.emit({ type: "submit.confirmed", url: after.url, domain: hostOf(after.url) ?? domain, detail: { gateId: this.host.gateId } });
+        // Look REPEATEDLY, not once (#994). The old path waited two seconds and read the page a
+        // single time, so a receipt that arrives on a navigation or a client-side re-render a moment
+        // later was simply not there yet when the only look happened. `submitAttempted` is already
+        // true above, so waiting longer cannot make a pressed button look unpressed.
+        const { after, looks } = res.isError ? { after: null, looks: 0 } : await this.awaitConfirmation(before);
+        const seen = observe(before, after, looks);
+        this.confirmation = seen;
+        const evidence = { looks: seen.looks, urlChanged: seen.urlChanged, titleChanged: seen.titleChanged };
+        if (seen.marker) {
+            const at = after;
+            this.submitted = { url: at.url, at: new Date(this.host.now()).toISOString(), gateId: this.host.gateId };
+            this.host.emit({ type: "submit.confirmed", url: at.url, domain: hostOf(at.url) ?? domain, detail: { gateId: this.host.gateId, marker: seen.marker, ...evidence } });
             return text("Submitted, and the site confirmed it. Stop now.");
         }
         this.blocked = { reason: "submit_unconfirmed", questions: ["The application was submitted but the site did not confirm it. Check the employer's site or your email before anything is retried."] };
-        this.host.emit({ type: "submit.unconfirmed", ...(after ? { url: after.url } : {}), domain, detail: { gateId: this.host.gateId } });
+        this.host.emit({ type: "submit.unconfirmed", ...(after ? { url: after.url } : {}), domain, detail: { gateId: this.host.gateId, ...evidence } });
         return text("The submit was pressed but no confirmation was seen. Do not press it again. Stop now.", true);
     }
+    /**
+     * Read the page until it confirms, or until the looks run out (#994).
+     *
+     * It returns the LAST page it read, not the first: when nothing confirms, the owner's
+     * diagnostic should describe where the browser actually ended up. Bounded by
+     * `CONFIRMATION_LOOKS` — an application run holds the owner's only browser, so "look again"
+     * must never become "sit here".
+     */
+    async awaitConfirmation(before) {
+        let after = null;
+        for (let i = 0; i < CONFIRMATION_LOOKS; i++) {
+            await this.browser.callTool("browser_wait_for", { time: CONFIRMATION_INTERVAL_SECONDS }).catch(() => undefined);
+            const page = await this.inspect();
+            if (page)
+                after = page;
+            if (confirmationMarker(before, page))
+                return { after: page, looks: i + 1 };
+        }
+        return { after, looks: CONFIRMATION_LOOKS };
+    }
     /** A cloud-persisted checkpoint, not a prompt instruction, authorizes each page's writes. */
     requireSupervisor(tool, actionClass) {
         if (this.supervisorApproved)

package/dist/browser-runner/local-apply/confirmation.js

@@ -0,0 +1,125 @@
+/**
+ * Did the employer's site confirm the submission? (#994)
+ *
+ * ── The live failure this module exists for
+ *
+ * Three distinct approved auto-submit runs on `au.seek.com` reached `submit.attempted` and all
+ * three ended terminal `blocked / submit_unconfirmed` with `submittedAt=null`: applications
+ * `435d31c8…` (run `a4bf5c0f…`), `71765edd…` (run `76416747…`) and `b6244557…` (run `2f2e88a5…`).
+ * The honest safety state was right — nothing was retried, and the owner was told to check the
+ * employer's site — but a 3/3 rate says the DETECTOR was wrong, not the sites.
+ *
+ * Three facts about the old detector, each read off the code rather than guessed at:
+ *
+ *  1. **The vocabulary had no "sent".** It matched `thank you for (your) appl`,
+ *     `application (has been|was) (received|submitted)`, `we('ve| have) received your application`
+ *     and `successfully (applied|submitted)` — and nothing else. SEEK's own post-apply wording is
+ *     the "sent" family ("Application sent", "Your application has been sent", "You've applied"),
+ *     so the one word the page actually uses was the one word the regex could not see.
+ *  2. **It looked once, 2 seconds after the click** (`browser_wait_for {time: 2}` then one
+ *     `inspect()`), so a success state that arrives on a navigation or a client-side re-render a
+ *     moment later was simply not there yet when the only look happened.
+ *  3. **Text was the only evidence considered.** The URL the click navigates to, the title, and
+ *     the site's own "you have already applied" notice were all collected by `INSPECT_PAGE` and
+ *     none of them counted.
+ *
+ * What remains UNVERIFIED, and is stated here rather than implied: no live SEEK page was captured
+ * while writing this, so which of the three was decisive for those three runs is not established.
+ * The tests below use realistic fixtures of the wording SEEK and the big ATSs publish, which the
+ * issue explicitly allows; a live capture would still be worth taking.
+ *
+ * ── What counts as confirmation
+ *
+ * A named marker, never a feeling. Every marker is an id this platform defines, and only the ID
+ * crosses the contract — never the text that matched it. That is the same rule `signalsOf` follows
+ * in `runtime.ts` for engine output, and for the same reason: an application page holds the
+ * owner's typed answers, and no redaction reliably separates those from the rest of the prose.
+ *
+ * The URL and duplicate markers are deliberately comparative — they need the page as it was BEFORE
+ * the click, which the submit path already has. A `/success` URL that was already there is not
+ * evidence of this click; "you have already applied" that was already there is somebody's earlier
+ * application, not this one.
+ */
+/**
+ * The success vocabulary, as ONE source used in two places: this module (tested in Node) and the
+ * in-page script (built from `.source`, executed in the browser). Two copies of a regex is how the
+ * "sent" family went missing from one of them for three live runs.
+ *
+ * Lower-cased text is matched, so the patterns carry no case class.
+ */
+export const CONFIRMATION_TEXT_RE = /thank you for (your )?appl|application (has been |was )?(received|submitted|sent)|we('ve| have) received your application|successfully (applied|submitted|sent)|your application (is|has been) (on its way|complete)|you(r application)?('ve| have)? (now )?applied|applied (on|to this job)|application (sent|complete|submitted) *[.!]?$/;
+/**
+ * A URL that is itself the receipt. Matched against the path and query of the page the click
+ * landed on, and only when the click CHANGED it.
+ *
+ * Kept narrow on purpose: `/apply` alone is the form, not the confirmation, and treating it as one
+ * would turn "the click did nothing" into "submitted".
+ */
+export const CONFIRMATION_URL_RE = /(^|\/)(apply|application|applications|job)?[^/]*\/(success|succeeded|complete|completed|confirmation|confirmed|submitted|sent|thank-?you|receipt)(\/|$|\?)|[?&](applied|submitted|success)=(1|true|yes)/;
+/** Ordered by how strong the evidence is: the first match is the one recorded. */
+export function confirmationMarker(before, after) {
+    if (!after)
+        return null;
+    if (after.confirmed)
+        return "page_text";
+    const url = urlPathAndQuery(after.url).toLowerCase();
+    if (CONFIRMATION_URL_RE.test(url) && !!before && urlPathAndQuery(before.url).toLowerCase() !== url)
+        return "url_receipt";
+    // The site's own duplicate notice, but ONLY if it appeared after this click: "you have already
+    // applied" that was on the page beforehand is an earlier application of the owner's, and
+    // reading it as this run's success would record a submission that never happened.
+    if (after.duplicate && before && !before.duplicate)
+        return "already_applied_notice";
+    return null;
+}
+/** Path + query only: a host or a fragment is not evidence, and the host is recorded separately. */
+function urlPathAndQuery(raw) {
+    try {
+        const u = new URL(raw);
+        return `${u.pathname}${u.search}`;
+    }
+    catch {
+        return raw;
+    }
+}
+/**
+ * How long to keep looking, and how often.
+ *
+ * The old path waited 2s once. These are bounded for the reason every wait in this runner is: an
+ * application run holds the owner's only browser, so "look again" must not become "sit here". Six
+ * looks over ~9s covers a navigation and a client-side re-render, and stops long before the
+ * engine's own minute budget notices.
+ */
+export const CONFIRMATION_LOOKS = 6;
+export const CONFIRMATION_INTERVAL_SECONDS = 1.5;
+export function observe(before, after, looks) {
+    return {
+        marker: confirmationMarker(before, after),
+        looks,
+        urlChanged: !!after && !!before && after.url !== before.url,
+        titleChanged: !!after && !!before && after.title !== before.title,
+        unreadable: !after,
+    };
+}
+/**
+ * The closed-vocabulary signals that go on the run's diagnostic when a submit was pressed and not
+ * confirmed, so the owner's record says what was seen rather than only what was not.
+ *
+ * Each is an id, so nothing here can carry page text; together they distinguish the three cases a
+ * person would act on differently: the page never changed (the click may not have landed), the page
+ * moved but said nothing this detector knows (a wording to add), and the page could not be read.
+ */
+export function confirmationSignals(o) {
+    const out = [];
+    if (o.unreadable)
+        out.push("confirmation_page_unreadable");
+    else if (!o.marker)
+        out.push("confirmation_no_marker");
+    if (o.urlChanged)
+        out.push("confirmation_url_changed");
+    else if (!o.unreadable)
+        out.push("confirmation_url_unchanged");
+    if (o.titleChanged)
+        out.push("confirmation_title_changed");
+    return out;
+}

package/dist/browser-runner/local-apply/contract.js

@@ -82,31 +82,38 @@ export const LOCAL_APPLY_BLOCK_REASONS = [
  * dispatch, naming the update, rather than silently producing the older behaviour (`apply.ts`
  * `runnerContractProblem`).
  *
- * ── Why it moved to 0.4.85 (#989)
+ * ── Why it moved to 0.4.89 (#994)
  *
- * #985 fixed the runner's click classification — the press that OPENS a SEEK application stopped
- * being read as the final submit ({@link classifyApplyClick}) — and that fix lives in
- * `packages/browser-runner`, which ships INSIDE the published CLI. The commit did not bump
- * `packages/cli/package.json`, and `publish-npm.yml` publishes only a version that is new, so
- * nothing was published: the live machine kept running 0.4.84, whose bundled bridge still tests
- * `FALLBACK_COMMIT_RE`. The next live run therefore reproduced the defect the fix had already
- * removed from `main` — `browser_click → class: submit → refused: fill_and_review`, no `rule`
- * field, three seconds after the cloud's own `continue` — and the only durable evidence that the
- * code was old was the absence of a field nobody looks for.
+ * #994 makes a post-click confirmation observable and recognises SEEK's "application sent"
+ * receipt wording. It also carries only closed-vocabulary evidence when a pressed submit remains
+ * unconfirmed. Those changes live in `packages/browser-runner`, which ships INSIDE the published
+ * CLI. A machine below this floor cannot provide that evidence, so it must not silently look
+ * equivalent to a current runner.
  *
  * A behaviour change in the runner is a CONTRACT change, because the cloud's decisions assume it.
- * So this floor moves with it: a machine that cannot tell the entry control from the final submit
- * is refused with a sentence that says so, instead of ending `awaiting_review` having typed
- * nothing.
+ * So this floor moves with it: a machine that cannot observe a post-submit receipt is refused
+ * with a sentence that says so, rather than reporting an unhelpful `submit_unconfirmed` state.
  *
  * Bump this when the runner's half of the contract changes again, together with the CLI version
  * that ships it — `policy.test.ts` pins the pair, so the floor cannot name a release that has not
  * been published. `cliAtLeast` treats an unreported version as capable, which is the convention
  * every MIN_CLI gate here follows.
  */
-export const LOCAL_APPLY_CONTRACT_MIN_CLI = "0.4.85";
-export const LOCAL_APPLY_DIAGNOSTIC_CAUSES = ["bridge_unused", "engine_exited_nonzero", "timed_out", "no_engine_output"];
-export const LOCAL_APPLY_SIGNALS = ["approval_policy_blocked", "bridge_tools_missing", "auth_prompt", "no_output", "engine_refused_task"];
+export const LOCAL_APPLY_CONTRACT_MIN_CLI = "0.4.89";
+export const LOCAL_APPLY_DIAGNOSTIC_CAUSES = ["bridge_unused", "engine_exited_nonzero", "timed_out", "no_engine_output", "submit_unconfirmed"];
+export const LOCAL_APPLY_CONFIRMATION_MARKERS = ["page_text", "url_receipt", "already_applied_notice"];
+export const LOCAL_APPLY_SIGNALS = [
+    "approval_policy_blocked",
+    "bridge_tools_missing",
+    "auth_prompt",
+    "no_output",
+    "engine_refused_task",
+    "confirmation_no_marker",
+    "confirmation_page_unreadable",
+    "confirmation_url_changed",
+    "confirmation_url_unchanged",
+    "confirmation_title_changed",
+];
 export const LOCAL_APPLY_UNAVAILABLE_REASONS = ["expired", "unavailable"];
 export const LOCAL_APPLY_EVENT_TYPES = [
     "engine.auth_checked",
@@ -140,7 +147,11 @@ const isHttpUrl = (v) => /^https?:\/\/[^\s/]+/i.test(v);
 // submit since #985, and this whitelist silently dropped it — so the one fact that tells "it
 // refused the control that opens the form" from "it refused the real submit" never reached the
 // cloud trace, which is where the live investigation needed it.
-const DETAIL_KEYS = new Set(["engine", "authMode", "engineAuth", "mode", "class", "tool", "decision", "reason", "rule", "role", "kind", "path", "sha256", "bytes", "gateId", "exitCode", "count", "status", "basis", "source", "checkpointId", "directive", "phase", "actions", "filled", "uploaded"]);
+// `marker`, `looks`, `urlChanged` and `titleChanged` are #994's post-click evidence: a marker ID
+// from `LOCAL_APPLY_CONFIRMATION_MARKERS`, how many times the page was read, and whether it moved.
+// Each is an id, a count or a boolean — the same whitelist rule as everything else here, so no page
+// text and no typed value can ride along on a `submit.confirmed` / `submit.unconfirmed` event.
+const DETAIL_KEYS = new Set(["engine", "authMode", "engineAuth", "mode", "class", "tool", "decision", "reason", "rule", "role", "kind", "path", "sha256", "bytes", "gateId", "exitCode", "count", "status", "basis", "source", "checkpointId", "directive", "phase", "actions", "filled", "uploaded", "marker", "looks", "urlChanged", "titleChanged"]);
 /** A validated event, or null. Detail keeps only whitelisted, primitive, bounded values. */
 export function parseLocalApplyEvent(raw) {
     if (!raw || typeof raw !== "object")
@@ -167,6 +178,15 @@ export function parseLocalApplyEvent(raw) {
         for (const [k, v] of Object.entries(o.detail)) {
             if (!DETAIL_KEYS.has(k))
                 continue;
+            // #994: `marker` is a runner-defined confirmation ID, never the success sentence the
+            // page displayed. Keep the closed vocabulary closed even if a compromised/outdated
+            // runner tries to use this otherwise-string field as a prose channel.
+            if (k === "marker") {
+                const marker = oneOf(LOCAL_APPLY_CONFIRMATION_MARKERS, v);
+                if (marker)
+                    detail[k] = marker;
+                continue;
+            }
             if (typeof v === "string")
                 detail[k] = v.slice(0, 300);
             else if (typeof v === "number" || typeof v === "boolean")

package/dist/browser-runner/local-apply/runtime.js

@@ -33,6 +33,7 @@ import { redactText, secretEnvValues } from "../local-browser/contract.js";
 import { finalText, missingLogin, signInHelp } from "../local-browser/engine.js";
 import { resolveWorkspacePath } from "../local-browser/runtime.js";
 import { ApplyBridge } from "./bridge.js";
+import { confirmationSignals } from "./confirmation.js";
 import { LOCAL_APPLY_AUTH_MODES, LOCAL_APPLY_CAPS, LOCAL_APPLY_ENGINES, LOCAL_APPLY_MODES, LOCAL_APPLY_TASK_TYPE, } from "./contract.js";
 import { applyPrompt, buildApplyEngineSpec, observedApplyAuth } from "./engine.js";
 const MAX_EVENTS = 1000;
@@ -372,8 +373,20 @@ export class LocalApplyRuntime {
             return { outcome: "submitted", summary, submitted: b.submitted };
         if (b?.unavailable)
             return { outcome: "blocked", summary, blockReason: "job_unavailable", unavailable: b.unavailable };
-        if (b?.submitAttempted)
-            return { outcome: "blocked", summary, blockReason: "submit_unconfirmed", questions: b.blocked?.questions ?? [] };
+        // #994: a pressed submit nobody confirmed now SAYS what was seen. The outcome is unchanged —
+        // terminal, no retry, the owner told to check the employer's site — because that safety is
+        // correct; what was missing was any way to tell "the click never moved the page" from "the
+        // page moved and said something this platform does not recognise yet".
+        if (b?.submitAttempted) {
+            const d = this.diagnosticOf(run, code, "submit_unconfirmed");
+            return {
+                outcome: "blocked",
+                summary,
+                blockReason: "submit_unconfirmed",
+                questions: b.blocked?.questions ?? [],
+                diagnostic: { ...d, signals: [...d.signals, ...(b.confirmation ? confirmationSignals(b.confirmation) : [])] },
+            };
+        }
         if (b?.reviewReady)
             return { outcome: "awaiting_review", summary };
         if (!b?.filled && missingLogin(e.engine, run.output.join("\n")))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proagentstore/cli",
-  "version": "0.4.88",
+  "version": "0.4.89",
   "description": "CLI for creating, publishing, and running ProAgentStore agents",
   "license": "MIT",
   "type": "module",