@proagentstore/cli 0.4.88 → 0.4.90

package/dist/browser-runner/local-apply/bridge.js

@@ -25,6 +25,7 @@
  * The trace carries classes, domains, decisions and artifact handles — never a typed value.
  */
 import { classifyApplyClick } from "./contract.js";
+import { CONFIRMATION_INTERVAL_SECONDS, CONFIRMATION_LOOKS, CONFIRMATION_TEXT_RE, confirmationMarker, observe, } from "./confirmation.js";
 import { ELEMENT_PROBE_FN } from "../commit-guard.js";
 import { normalize } from "../local-artifact/engine.js";
 import { evaluateResult, hostOf, refRole } from "../local-browser/bridge.js";
@@ -58,8 +59,15 @@ const CONSENT_NAME = /\b(agree|consent|terms|privacy|acknowledge|certify|accept|
 const CREDENTIAL_NAME = /password|passcode|one[- ]?time|\botp\b|verification code|security code|2fa|two[- ]factor/i;
 /** Keys that move between fields without entering or activating anything. */
 const SAFE_KEYS = /^(Tab|Shift\+Tab|Arrow(Up|Down|Left|Right)|Escape|Home|End|PageUp|PageDown)$/;
-/** Runs inside the page, through the browser's own evaluate tool — never offered to the CLI. */
+/**
+ * Runs inside the page, through the browser's own evaluate tool — never offered to the CLI.
+ *
+ * The success vocabulary is INTERPOLATED from `confirmation.ts` rather than written out here
+ * (#994): a second copy of that regex is how the "sent" family — the exact word SEEK uses — was
+ * missing from the detector while being present in nobody's tests, through three live runs.
+ */
 const INSPECT_PAGE = `() => {
+	const CONFIRMATION_TEXT_SOURCE = ${JSON.stringify(CONFIRMATION_TEXT_RE.source)};
 	const text = (document.body ? document.body.innerText : "").slice(0, 20000).toLowerCase();
 	const has = (s) => !!document.querySelector(s);
 	return {
@@ -70,7 +78,7 @@ const INSPECT_PAGE = `() => {
 		login: has('input[type=password]'),
 		duplicate: /you('ve| have) already applied|already applied (for|to) this|application (already exists|has already been (submitted|received))|duplicate application/.test(text),
 		antiBot: /unusual traffic|access (is )?denied|request (has been )?blocked|bot detected|checking (if the site connection is secure|your browser)/.test(text),
-		confirmed: /thank you for (your )?appl|application (has been |was )?(received|submitted)|we('ve| have) received your application|successfully (applied|submitted)/.test(text),
+		confirmed: new RegExp(CONFIRMATION_TEXT_SOURCE).test(text),
 		unavailable: /(?:this |the )?(?:job|position|posting|role|opportunity).{0,120}(?:has )?(?:expired|closed|been filled|is no longer available|is no longer accepting applications)|(?:expired|closed|no longer available|no longer accepting applications).{0,120}(?:job|position|posting|role|opportunity)/.test(text)
 			? (/expired/.test(text) ? "expired" : "unavailable")
 			: null,
@@ -120,6 +128,8 @@ export class ApplyBridge {
     /** Present only after the CLI explicitly reports a notice that the runner independently saw. */
     unavailable = null;
     submitAttempted = false;
+    /** What was seen after the submit click (#994) — read by the runtime to build the diagnostic. */
+    confirmation = null;
     submitted = null;
     /** The last thing that stopped the work and was not resolved — the block reason if the run ends here. */
     blocked = null;
@@ -609,17 +619,44 @@ export class ApplyBridge {
         this.submitAttempted = true;
         this.host.emit({ type: "submit.attempted", url: before.url, domain, detail: { class: "submit", gateId: this.host.gateId } });
         const res = await this.browser.callTool("browser_click", forward);
-        await this.browser.callTool("browser_wait_for", { time: 2 }).catch(() => undefined);
-        const after = res.isError ? null : await this.inspect();
-        if (after?.confirmed) {
-            this.submitted = { url: after.url, at: new Date(this.host.now()).toISOString(), gateId: this.host.gateId };
-            this.host.emit({ type: "submit.confirmed", url: after.url, domain: hostOf(after.url) ?? domain, detail: { gateId: this.host.gateId } });
+        // Look REPEATEDLY, not once (#994). The old path waited two seconds and read the page a
+        // single time, so a receipt that arrives on a navigation or a client-side re-render a moment
+        // later was simply not there yet when the only look happened. `submitAttempted` is already
+        // true above, so waiting longer cannot make a pressed button look unpressed.
+        const { after, looks } = res.isError ? { after: null, looks: 0 } : await this.awaitConfirmation(before);
+        const seen = observe(before, after, looks);
+        this.confirmation = seen;
+        const evidence = { looks: seen.looks, urlChanged: seen.urlChanged, titleChanged: seen.titleChanged };
+        if (seen.marker) {
+            const at = after;
+            this.submitted = { url: at.url, at: new Date(this.host.now()).toISOString(), gateId: this.host.gateId };
+            this.host.emit({ type: "submit.confirmed", url: at.url, domain: hostOf(at.url) ?? domain, detail: { gateId: this.host.gateId, marker: seen.marker, ...evidence } });
             return text("Submitted, and the site confirmed it. Stop now.");
         }
         this.blocked = { reason: "submit_unconfirmed", questions: ["The application was submitted but the site did not confirm it. Check the employer's site or your email before anything is retried."] };
-        this.host.emit({ type: "submit.unconfirmed", ...(after ? { url: after.url } : {}), domain, detail: { gateId: this.host.gateId } });
+        this.host.emit({ type: "submit.unconfirmed", ...(after ? { url: after.url } : {}), domain, detail: { gateId: this.host.gateId, ...evidence } });
         return text("The submit was pressed but no confirmation was seen. Do not press it again. Stop now.", true);
     }
+    /**
+     * Read the page until it confirms, or until the looks run out (#994).
+     *
+     * It returns the LAST page it read, not the first: when nothing confirms, the owner's
+     * diagnostic should describe where the browser actually ended up. Bounded by
+     * `CONFIRMATION_LOOKS` — an application run holds the owner's only browser, so "look again"
+     * must never become "sit here".
+     */
+    async awaitConfirmation(before) {
+        let after = null;
+        for (let i = 0; i < CONFIRMATION_LOOKS; i++) {
+            await this.browser.callTool("browser_wait_for", { time: CONFIRMATION_INTERVAL_SECONDS }).catch(() => undefined);
+            const page = await this.inspect();
+            if (page)
+                after = page;
+            if (confirmationMarker(before, page))
+                return { after: page, looks: i + 1 };
+        }
+        return { after, looks: CONFIRMATION_LOOKS };
+    }
     /** A cloud-persisted checkpoint, not a prompt instruction, authorizes each page's writes. */
     requireSupervisor(tool, actionClass) {
         if (this.supervisorApproved)

package/dist/browser-runner/local-apply/confirmation.js

@@ -0,0 +1,125 @@
+/**
+ * Did the employer's site confirm the submission? (#994)
+ *
+ * ── The live failure this module exists for
+ *
+ * Three distinct approved auto-submit runs on `au.seek.com` reached `submit.attempted` and all
+ * three ended terminal `blocked / submit_unconfirmed` with `submittedAt=null`: applications
+ * `435d31c8…` (run `a4bf5c0f…`), `71765edd…` (run `76416747…`) and `b6244557…` (run `2f2e88a5…`).
+ * The honest safety state was right — nothing was retried, and the owner was told to check the
+ * employer's site — but a 3/3 rate says the DETECTOR was wrong, not the sites.
+ *
+ * Three facts about the old detector, each read off the code rather than guessed at:
+ *
+ *  1. **The vocabulary had no "sent".** It matched `thank you for (your) appl`,
+ *     `application (has been|was) (received|submitted)`, `we('ve| have) received your application`
+ *     and `successfully (applied|submitted)` — and nothing else. SEEK's own post-apply wording is
+ *     the "sent" family ("Application sent", "Your application has been sent", "You've applied"),
+ *     so the one word the page actually uses was the one word the regex could not see.
+ *  2. **It looked once, 2 seconds after the click** (`browser_wait_for {time: 2}` then one
+ *     `inspect()`), so a success state that arrives on a navigation or a client-side re-render a
+ *     moment later was simply not there yet when the only look happened.
+ *  3. **Text was the only evidence considered.** The URL the click navigates to, the title, and
+ *     the site's own "you have already applied" notice were all collected by `INSPECT_PAGE` and
+ *     none of them counted.
+ *
+ * What remains UNVERIFIED, and is stated here rather than implied: no live SEEK page was captured
+ * while writing this, so which of the three was decisive for those three runs is not established.
+ * The tests below use realistic fixtures of the wording SEEK and the big ATSs publish, which the
+ * issue explicitly allows; a live capture would still be worth taking.
+ *
+ * ── What counts as confirmation
+ *
+ * A named marker, never a feeling. Every marker is an id this platform defines, and only the ID
+ * crosses the contract — never the text that matched it. That is the same rule `signalsOf` follows
+ * in `runtime.ts` for engine output, and for the same reason: an application page holds the
+ * owner's typed answers, and no redaction reliably separates those from the rest of the prose.
+ *
+ * The URL and duplicate markers are deliberately comparative — they need the page as it was BEFORE
+ * the click, which the submit path already has. A `/success` URL that was already there is not
+ * evidence of this click; "you have already applied" that was already there is somebody's earlier
+ * application, not this one.
+ */
+/**
+ * The success vocabulary, as ONE source used in two places: this module (tested in Node) and the
+ * in-page script (built from `.source`, executed in the browser). Two copies of a regex is how the
+ * "sent" family went missing from one of them for three live runs.
+ *
+ * Lower-cased text is matched, so the patterns carry no case class.
+ */
+export const CONFIRMATION_TEXT_RE = /thank you for (your )?appl|application (has been |was )?(received|submitted|sent)|we('ve| have) received your application|successfully (applied|submitted|sent)|your application (is|has been) (on its way|complete)|you(r application)?('ve| have)? (now )?applied|applied (on|to this job)|application (sent|complete|submitted) *[.!]?$/;
+/**
+ * A URL that is itself the receipt. Matched against the path and query of the page the click
+ * landed on, and only when the click CHANGED it.
+ *
+ * Kept narrow on purpose: `/apply` alone is the form, not the confirmation, and treating it as one
+ * would turn "the click did nothing" into "submitted".
+ */
+export const CONFIRMATION_URL_RE = /(^|\/)(apply|application|applications|job)?[^/]*\/(success|succeeded|complete|completed|confirmation|confirmed|submitted|sent|thank-?you|receipt)(\/|$|\?)|[?&](applied|submitted|success)=(1|true|yes)/;
+/** Ordered by how strong the evidence is: the first match is the one recorded. */
+export function confirmationMarker(before, after) {
+    if (!after)
+        return null;
+    if (after.confirmed)
+        return "page_text";
+    const url = urlPathAndQuery(after.url).toLowerCase();
+    if (CONFIRMATION_URL_RE.test(url) && before && urlPathAndQuery(before.url).toLowerCase() !== url)
+        return "url_receipt";
+    // The site's own duplicate notice, but ONLY if it appeared after this click: "you have already
+    // applied" that was on the page beforehand is an earlier application of the owner's, and
+    // reading it as this run's success would record a submission that never happened.
+    if (after.duplicate && before && !before.duplicate)
+        return "already_applied_notice";
+    return null;
+}
+/** Path + query only: a host or a fragment is not evidence, and the host is recorded separately. */
+function urlPathAndQuery(raw) {
+    try {
+        const u = new URL(raw);
+        return `${u.pathname}${u.search}`;
+    }
+    catch {
+        return raw;
+    }
+}
+/**
+ * How long to keep looking, and how often.
+ *
+ * The old path waited 2s once. These are bounded for the reason every wait in this runner is: an
+ * application run holds the owner's only browser, so "look again" must not become "sit here". Six
+ * looks over ~9s covers a navigation and a client-side re-render, and stops long before the
+ * engine's own minute budget notices.
+ */
+export const CONFIRMATION_LOOKS = 6;
+export const CONFIRMATION_INTERVAL_SECONDS = 1.5;
+export function observe(before, after, looks) {
+    return {
+        marker: confirmationMarker(before, after),
+        looks,
+        urlChanged: !!after && !!before && after.url !== before.url,
+        titleChanged: !!after && !!before && after.title !== before.title,
+        unreadable: !after,
+    };
+}
+/**
+ * The closed-vocabulary signals that go on the run's diagnostic when a submit was pressed and not
+ * confirmed, so the owner's record says what was seen rather than only what was not.
+ *
+ * Each is an id, so nothing here can carry page text; together they distinguish the three cases a
+ * person would act on differently: the page never changed (the click may not have landed), the page
+ * moved but said nothing this detector knows (a wording to add), and the page could not be read.
+ */
+export function confirmationSignals(o) {
+    const out = [];
+    if (o.unreadable)
+        out.push("confirmation_page_unreadable");
+    else if (!o.marker)
+        out.push("confirmation_no_marker");
+    if (o.urlChanged)
+        out.push("confirmation_url_changed");
+    else if (!o.unreadable)
+        out.push("confirmation_url_unchanged");
+    if (o.titleChanged)
+        out.push("confirmation_title_changed");
+    return out;
+}

package/dist/browser-runner/local-apply/contract.js

@@ -31,6 +31,8 @@ export const LOCAL_APPLY_RUN_PATH = "/local-apply/run";
 export const LOCAL_APPLY_STATUS_PATH = "/local-apply/status";
 export const LOCAL_APPLY_RESUME_PATH = "/local-apply/resume";
 export const LOCAL_APPLY_CANCEL_PATH = "/local-apply/cancel";
+/** Read-only job-page check used before an email lead may enter material preparation. */
+export const LOCAL_APPLY_PREFLIGHT_PATH = "/local-apply/preflight";
 /** Delivers a cloud-persisted supervisory decision to one paused checkpoint. */
 export const LOCAL_APPLY_DIRECTIVE_PATH = "/local-apply/directive";
 export const LOCAL_APPLY_ENGINES = ["claude", "codex"];
@@ -82,31 +84,37 @@ export const LOCAL_APPLY_BLOCK_REASONS = [
  * dispatch, naming the update, rather than silently producing the older behaviour (`apply.ts`
  * `runnerContractProblem`).
  *
- * ── Why it moved to 0.4.85 (#989)
+ * ── Why it moved to 0.4.90 (#953)
  *
- * #985 fixed the runner's click classification — the press that OPENS a SEEK application stopped
- * being read as the final submit ({@link classifyApplyClick}) — and that fix lives in
- * `packages/browser-runner`, which ships INSIDE the published CLI. The commit did not bump
- * `packages/cli/package.json`, and `publish-npm.yml` publishes only a version that is new, so
- * nothing was published: the live machine kept running 0.4.84, whose bundled bridge still tests
- * `FALLBACK_COMMIT_RE`. The next live run therefore reproduced the defect the fix had already
- * removed from `main` — `browser_click → class: submit → refused: fill_and_review`, no `rule`
- * field, three seconds after the cloud's own `continue` — and the only durable evidence that the
- * code was old was the absence of a field nobody looks for.
+ * #953 adds the read-only `/local-apply/preflight` route used before an email lead can enter
+ * tailoring. That route lives in `packages/browser-runner`, which ships INSIDE the published CLI.
+ * A machine below this floor cannot make the live/expired/unverifiable observation, so it must
+ * not silently look equivalent to a current runner.
  *
  * A behaviour change in the runner is a CONTRACT change, because the cloud's decisions assume it.
- * So this floor moves with it: a machine that cannot tell the entry control from the final submit
- * is refused with a sentence that says so, instead of ending `awaiting_review` having typed
- * nothing.
+ * So this floor moves with it: a machine that cannot observe a post-submit receipt is refused
+ * with a sentence that says so, rather than reporting an unhelpful `submit_unconfirmed` state.
  *
  * Bump this when the runner's half of the contract changes again, together with the CLI version
  * that ships it — `policy.test.ts` pins the pair, so the floor cannot name a release that has not
  * been published. `cliAtLeast` treats an unreported version as capable, which is the convention
  * every MIN_CLI gate here follows.
  */
-export const LOCAL_APPLY_CONTRACT_MIN_CLI = "0.4.85";
-export const LOCAL_APPLY_DIAGNOSTIC_CAUSES = ["bridge_unused", "engine_exited_nonzero", "timed_out", "no_engine_output"];
-export const LOCAL_APPLY_SIGNALS = ["approval_policy_blocked", "bridge_tools_missing", "auth_prompt", "no_output", "engine_refused_task"];
+export const LOCAL_APPLY_CONTRACT_MIN_CLI = "0.4.90";
+export const LOCAL_APPLY_DIAGNOSTIC_CAUSES = ["bridge_unused", "engine_exited_nonzero", "timed_out", "no_engine_output", "submit_unconfirmed"];
+export const LOCAL_APPLY_CONFIRMATION_MARKERS = ["page_text", "url_receipt", "already_applied_notice"];
+export const LOCAL_APPLY_SIGNALS = [
+    "approval_policy_blocked",
+    "bridge_tools_missing",
+    "auth_prompt",
+    "no_output",
+    "engine_refused_task",
+    "confirmation_no_marker",
+    "confirmation_page_unreadable",
+    "confirmation_url_changed",
+    "confirmation_url_unchanged",
+    "confirmation_title_changed",
+];
 export const LOCAL_APPLY_UNAVAILABLE_REASONS = ["expired", "unavailable"];
 export const LOCAL_APPLY_EVENT_TYPES = [
     "engine.auth_checked",
@@ -140,7 +148,11 @@ const isHttpUrl = (v) => /^https?:\/\/[^\s/]+/i.test(v);
 // submit since #985, and this whitelist silently dropped it — so the one fact that tells "it
 // refused the control that opens the form" from "it refused the real submit" never reached the
 // cloud trace, which is where the live investigation needed it.
-const DETAIL_KEYS = new Set(["engine", "authMode", "engineAuth", "mode", "class", "tool", "decision", "reason", "rule", "role", "kind", "path", "sha256", "bytes", "gateId", "exitCode", "count", "status", "basis", "source", "checkpointId", "directive", "phase", "actions", "filled", "uploaded"]);
+// `marker`, `looks`, `urlChanged` and `titleChanged` are #994's post-click evidence: a marker ID
+// from `LOCAL_APPLY_CONFIRMATION_MARKERS`, how many times the page was read, and whether it moved.
+// Each is an id, a count or a boolean — the same whitelist rule as everything else here, so no page
+// text and no typed value can ride along on a `submit.confirmed` / `submit.unconfirmed` event.
+const DETAIL_KEYS = new Set(["engine", "authMode", "engineAuth", "mode", "class", "tool", "decision", "reason", "rule", "role", "kind", "path", "sha256", "bytes", "gateId", "exitCode", "count", "status", "basis", "source", "checkpointId", "directive", "phase", "actions", "filled", "uploaded", "marker", "looks", "urlChanged", "titleChanged"]);
 /** A validated event, or null. Detail keeps only whitelisted, primitive, bounded values. */
 export function parseLocalApplyEvent(raw) {
     if (!raw || typeof raw !== "object")
@@ -167,6 +179,15 @@ export function parseLocalApplyEvent(raw) {
         for (const [k, v] of Object.entries(o.detail)) {
             if (!DETAIL_KEYS.has(k))
                 continue;
+            // #994: `marker` is a runner-defined confirmation ID, never the success sentence the
+            // page displayed. Keep the closed vocabulary closed even if a compromised/outdated
+            // runner tries to use this otherwise-string field as a prose channel.
+            if (k === "marker") {
+                const marker = oneOf(LOCAL_APPLY_CONFIRMATION_MARKERS, v);
+                if (marker)
+                    detail[k] = marker;
+                continue;
+            }
             if (typeof v === "string")
                 detail[k] = v.slice(0, 300);
             else if (typeof v === "number" || typeof v === "boolean")

package/dist/browser-runner/local-apply/runtime.js

@@ -15,12 +15,13 @@
  *  - the result: `awaiting_review`, `submitted` (only with the site's confirmation), `blocked`
  *    with the reason, or `failed`.
  *
- * Runs live in memory: a runner restart loses them, and `status` answers 404, which PAGS reads as
- * "the runner lost this run".
+ * Active runs live in memory: a runner restart loses them, and `status` answers 404, which PAGS
+ * reads as "the runner lost this run". Terminal typed/redacted results are journaled locally so a
+ * restart after completion does not erase observed evidence before PAGS pulls it.
  */
 import { spawn as nodeSpawn } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -33,7 +34,8 @@ import { redactText, secretEnvValues } from "../local-browser/contract.js";
 import { finalText, missingLogin, signInHelp } from "../local-browser/engine.js";
 import { resolveWorkspacePath } from "../local-browser/runtime.js";
 import { ApplyBridge } from "./bridge.js";
-import { LOCAL_APPLY_AUTH_MODES, LOCAL_APPLY_CAPS, LOCAL_APPLY_ENGINES, LOCAL_APPLY_MODES, LOCAL_APPLY_TASK_TYPE, } from "./contract.js";
+import { confirmationSignals } from "./confirmation.js";
+import { LOCAL_APPLY_AUTH_MODES, LOCAL_APPLY_CAPS, LOCAL_APPLY_ENGINES, LOCAL_APPLY_MODES, LOCAL_APPLY_TASK_TYPE, parseLocalApplyResult, } from "./contract.js";
 import { applyPrompt, buildApplyEngineSpec, observedApplyAuth } from "./engine.js";
 const MAX_EVENTS = 1000;
 const OUTPUT_LINES = 400;
@@ -181,6 +183,104 @@ export class LocalApplyRuntime {
         this.now = deps.now ?? Date.now;
         this.spawn = deps.spawn ?? nodeSpawn;
         this.retentionMs = deps.retentionMs ?? 24 * 60 * 60 * 1000;
+        this.hydrateTerminalJournals();
+    }
+    /**
+     * Read a specific job page before an email alert can cause any materials to be generated.
+     * This deliberately creates no application run, launches no CLI, and never clicks/fills: the
+     * only evidence it returns is a closed, redacted vocabulary the API can durably record.
+     */
+    async preflight(raw) {
+        const input = raw && typeof raw === "object" ? raw : {};
+        const jobUrl = typeof input.jobUrl === "string" ? input.jobUrl.trim() : "";
+        let parsed;
+        try {
+            parsed = new URL(jobUrl);
+            if (parsed.protocol !== "http:" && parsed.protocol !== "https:")
+                throw new Error("scheme");
+        }
+        catch {
+            return { state: "unverifiable", jobUrl, reason: "navigation_failed" };
+        }
+        const profile = input.browserProfile === "default" ? "default" : "isolated";
+        const dir = join(this.root, "preflight", randomBytes(12).toString("hex"));
+        let browser = null;
+        try {
+            browser = await this.deps.browserFor(profile, dir);
+            const navigated = await browser.tools.callTool("browser_navigate", { url: parsed.toString() });
+            if (navigated.isError)
+                return { state: "unverifiable", jobUrl: parsed.toString(), reason: "navigation_failed" };
+            const snapshot = await browser.tools.callTool("browser_snapshot");
+            const page = (snapshot.content ?? []).map((part) => part.text ?? "").join("\n");
+            if (snapshot.isError || /captcha|verify (?:you(?:'| a)re|that you are) human|access denied|unusual traffic|checking (?:if )?your browser/i.test(page)) {
+                return { state: "unverifiable", jobUrl: parsed.toString(), reason: "access_blocked" };
+            }
+            if (/(?:job|position|posting|role|opportunity).{0,120}(?:has )?(?:expired|closed|been filled|is no longer available|is no longer accepting applications)|(?:expired|closed|no longer available|no longer accepting applications).{0,120}(?:job|position|posting|role|opportunity)/i.test(page)) {
+                return { state: "unavailable", jobUrl: parsed.toString(), reason: /expired/i.test(page) ? "expired" : "unavailable" };
+            }
+            // An accessible Apply control is an active path, unlike a generic careers/search URL.
+            if (/(?:button|link)\s+"[^"]{0,80}\bapply(?: now| for| here)?\b|\bapply (?:now|for (?:this )?(?:job|role|position))\b|\bstart application\b/i.test(page)) {
+                return { state: "live", jobUrl: parsed.toString(), applyUrl: parsed.toString(), evidence: "apply_control_present" };
+            }
+            return { state: "unverifiable", jobUrl: parsed.toString(), reason: "no_active_apply_path" };
+        }
+        catch {
+            return { state: "unverifiable", jobUrl: parsed.toString(), reason: "navigation_failed" };
+        }
+        finally {
+            await browser?.stop().catch(() => undefined);
+        }
+    }
+    journalPath(dir) {
+        return join(dir, "terminal-result.json");
+    }
+    /** Write-before-return: a terminal result is durable before `status` can expose it. */
+    persistTerminal(run) {
+        if (!run.result || !run.endedAt)
+            return;
+        const journal = { version: 1, envelope: run.envelope, events: run.events, seq: run.seq, result: run.result, endedAt: run.endedAt };
+        const path = this.journalPath(run.dir);
+        const tmp = `${path}.${randomBytes(8).toString("hex")}.tmp`;
+        writeFileSync(tmp, JSON.stringify(journal), { mode: 0o600 });
+        renameSync(tmp, path);
+    }
+    /** Hydrate terminal-only records. Interrupted runs remain deliberately unrecoverable. */
+    hydrateTerminalJournals() {
+        if (!existsSync(this.root))
+            return;
+        for (const instance of readdirSync(this.root)) {
+            const instanceDir = join(this.root, instance);
+            let runIds;
+            try {
+                runIds = readdirSync(instanceDir);
+            }
+            catch {
+                continue;
+            }
+            for (const runId of runIds) {
+                const dir = join(instanceDir, runId);
+                const path = this.journalPath(dir);
+                if (!existsSync(path))
+                    continue;
+                try {
+                    const raw = JSON.parse(readFileSync(path, "utf8"));
+                    if (raw.version !== 1 || !raw.envelope || !raw.result || !Array.isArray(raw.events) || typeof raw.seq !== "number" || typeof raw.endedAt !== "number")
+                        continue;
+                    const envelope = parseApplyEnvelope(raw.envelope);
+                    const parsed = parseLocalApplyResult(raw.result);
+                    if ("error" in parsed || parsed.result.runId !== envelope.runId)
+                        continue;
+                    const checked = parsed.result;
+                    this.runs.set(envelope.runId, {
+                        envelope, dir, token: "", state: "ended", events: raw.events, seq: raw.seq,
+                        result: checked, allow: new Set(envelope.policy.allowDomains), grounding: [], secrets: [], activeSince: raw.endedAt,
+                        activeMs: 0, waiters: [], output: [], engineAuth: checked.engineAuth, cancelled: false, timedOut: false,
+                        checkpoints: new Map(), endedAt: raw.endedAt,
+                    });
+                }
+                catch { /* a corrupt local cache is never an authority */ }
+            }
+        }
     }
     start(raw) {
         const envelope = parseApplyEnvelope(raw);
@@ -372,8 +472,20 @@ export class LocalApplyRuntime {
             return { outcome: "submitted", summary, submitted: b.submitted };
         if (b?.unavailable)
             return { outcome: "blocked", summary, blockReason: "job_unavailable", unavailable: b.unavailable };
-        if (b?.submitAttempted)
-            return { outcome: "blocked", summary, blockReason: "submit_unconfirmed", questions: b.blocked?.questions ?? [] };
+        // #994: a pressed submit nobody confirmed now SAYS what was seen. The outcome is unchanged —
+        // terminal, no retry, the owner told to check the employer's site — because that safety is
+        // correct; what was missing was any way to tell "the click never moved the page" from "the
+        // page moved and said something this platform does not recognise yet".
+        if (b?.submitAttempted) {
+            const d = this.diagnosticOf(run, code, "submit_unconfirmed");
+            return {
+                outcome: "blocked",
+                summary,
+                blockReason: "submit_unconfirmed",
+                questions: b.blocked?.questions ?? [],
+                diagnostic: { ...d, signals: [...d.signals, ...(b.confirmation ? confirmationSignals(b.confirmation) : [])] },
+            };
+        }
         if (b?.reviewReady)
             return { outcome: "awaiting_review", summary };
         if (!b?.filled && missingLogin(e.engine, run.output.join("\n")))
@@ -601,6 +713,9 @@ export class LocalApplyRuntime {
             // nothing here is text: counts, an exit code, and signal ids this platform defines.
             ...(r.diagnostic ? { diagnostic: r.diagnostic } : {}),
         };
+        // This must happen before stopping the browser or exposing `ended`: a process restart in the
+        // narrow handoff window must not turn an observed result into `runner_lost` in the cloud.
+        this.persistTerminal(run);
         if (run.child && run.child.exitCode === null)
             this.kill(run);
         void run.browser?.stop().catch(() => undefined);

package/dist/browser-runner/local-artifact/contract.js

@@ -32,6 +32,7 @@ export const LOCAL_ARTIFACT_BLOCK_REASONS = [
     "workspace_unavailable",
     "missing_information",
     "uncertain_claim",
+    "invalid_cli_output",
     "engine_not_signed_in",
     "api_key_refused",
 ];
@@ -48,6 +49,7 @@ export const LOCAL_ARTIFACT_EVENT_TYPES = [
     "note",
 ];
 export const LOCAL_ARTIFACT_ENGINE_AUTHS = ["machine-login", "subscription", "api-key", "missing_login", "unknown"];
+export const LOCAL_ARTIFACT_PARSE_ATTEMPTS = ["fenced_json", "balanced_object"];
 export const LOCAL_ARTIFACT_CAPS = { questions: 20, questionChars: 300, sources: 6, sourceBytes: 256 * 1024 };
 /** An id used as a folder name: no separators, no dots, nothing a path could be built out of. */
 export const PATH_SEGMENT = /^[A-Za-z0-9_-]{1,100}$/;
@@ -88,6 +90,7 @@ export function parseLocalArtifactLead(raw) {
     const leadUrl = str(o.leadUrl, 2000) ?? "";
     if (leadUrl && !/^https?:\/\/[^\s/]+/i.test(leadUrl))
         return { error: "the lead's URL is not an http(s) URL" };
+    const workKey = str(o.workKey, 600);
     const requestedAt = str(o.requestedAt, 40);
     if (!requestedAt || Number.isNaN(Date.parse(requestedAt)))
         return { error: "the lead has no requestedAt time" };
@@ -101,9 +104,9 @@ export function parseLocalArtifactLead(raw) {
         if (v)
             lead[f] = v;
     }
-    return { lead: { eventId, sourceInstanceId, leadId, leadUrl, lifecycleVersion, requestedAt, lead } };
+    return { lead: { eventId, sourceInstanceId, leadId, leadUrl, ...(workKey ? { workKey } : {}), lifecycleVersion, requestedAt, lead } };
 }
-const DETAIL_KEYS = new Set(["engine", "authMode", "engineAuth", "role", "path", "sha256", "bytes", "kind", "total", "unmatched", "reason", "exitCode", "count", "removed", "status"]);
+const DETAIL_KEYS = new Set(["engine", "authMode", "engineAuth", "role", "path", "sha256", "bytes", "kind", "total", "unmatched", "reason", "exitCode", "count", "removed", "status", "validationError", "parseAttempts", "rawOutputChars", "runId", "attemptNumber"]);
 /** A validated event, or null. Detail keeps only whitelisted, primitive, bounded values. */
 export function parseLocalArtifactEvent(raw) {
     if (!raw || typeof raw !== "object")
@@ -181,6 +184,25 @@ export function parseLocalArtifactResult(raw) {
             .filter((q) => typeof q === "string" && q.trim() !== "")
             .slice(0, LOCAL_ARTIFACT_CAPS.questions)
             .map((q) => q.trim().slice(0, LOCAL_ARTIFACT_CAPS.questionChars));
+        const diagnostic = o.diagnostic && typeof o.diagnostic === "object" ? o.diagnostic : null;
+        const validationError = diagnostic?.validationError;
+        if (diagnostic && (validationError === "no_json_object" || validationError === "invalid_json" || validationError === "not_draft_object" || validationError === "incomplete_draft" || validationError === "unverified_claim")) {
+            const parseAttempts = [];
+            if (Array.isArray(diagnostic.parseAttempts)) {
+                for (let index = 0; index < diagnostic.parseAttempts.length && index < 8; index += 1) {
+                    const parseAttempt = oneOf(LOCAL_ARTIFACT_PARSE_ATTEMPTS, diagnostic.parseAttempts[index]);
+                    if (parseAttempt && !parseAttempts.includes(parseAttempt))
+                        parseAttempts.push(parseAttempt);
+                }
+            }
+            out.diagnostic = {
+                validationError,
+                parseAttempts,
+                rawOutputChars: typeof diagnostic.rawOutputChars === "number" ? Math.max(0, Math.min(diagnostic.rawOutputChars, 200_000)) : 0,
+                runId: str(diagnostic.runId, 100) ?? runId,
+                attemptNumber: typeof diagnostic.attemptNumber === "number" && Number.isInteger(diagnostic.attemptNumber) && diagnostic.attemptNumber > 0 ? diagnostic.attemptNumber : 1,
+            };
+        }
     }
     if (outcome === "failed")
         out.error = str(o.error, 1000) ?? "The run failed without a reason.";

package/dist/browser-runner/local-artifact/engine.js

@@ -19,8 +19,8 @@
  */
 import { mergeEnv } from "../coding/engine-env.js";
 import { resolveEngineAuth } from "../coding/engine-auth.js";
-import { finalText, missingLogin } from "../local-browser/engine.js";
-export { finalText, missingLogin };
+import { finalText as finalTextFromEngine, missingLogin } from "../local-browser/engine.js";
+export { missingLogin };
 const PROVIDER_KEYS = ["ANTHROPIC_API_KEY", "OPENAI_API_KEY"];
 const SUBSCRIPTION_TOKEN = "CLAUDE_CODE_OAUTH_TOKEN";
 /** The engine's environment: the machine's, never with a provider API key. */
@@ -84,19 +84,64 @@ export function tailorPrompt(lead, sources) {
         '{"status":"ready","resume_markdown":"…","cover_letter_markdown":"…","claims":[{"text":"…","source":"resume","quote":"…"}]}',
     ].join("\n");
 }
-/** The CLI's answer: the first JSON object in its final text, fences and prose around it ignored. */
-export function parseDraft(text) {
-    const start = text.indexOf("{");
-    const end = text.lastIndexOf("}");
-    if (start < 0 || end <= start)
-        return null;
-    try {
-        const v = JSON.parse(text.slice(start, end + 1));
-        return v && typeof v === "object" && !Array.isArray(v) ? v : null;
+/** JSON objects from fenced blocks or prose, while respecting braces inside JSON strings. */
+function jsonCandidates(text) {
+    const candidates = [];
+    for (const match of text.matchAll(/```(?:json)?\s*([\s\S]*?)```/gi))
+        candidates.push({ source: "fenced_json", text: match[1].trim() });
+    for (let start = 0; start < text.length; start++) {
+        if (text[start] !== "{")
+            continue;
+        let quoted = false, escaped = false, depth = 0;
+        for (let end = start; end < text.length; end++) {
+            const ch = text[end];
+            if (quoted) {
+                if (escaped)
+                    escaped = false;
+                else if (ch === "\\")
+                    escaped = true;
+                else if (ch === '"')
+                    quoted = false;
+                continue;
+            }
+            if (ch === '"')
+                quoted = true;
+            else if (ch === "{")
+                depth++;
+            else if (ch === "}" && --depth === 0) {
+                candidates.push({ source: "balanced_object", text: text.slice(start, end + 1) });
+                break;
+            }
+        }
     }
-    catch {
-        return null;
+    return candidates;
+}
+/** Prefer the structured closing message, but tolerate a CLI that printed a JSON object directly.
+ * Non-JSON output must stay empty so login and process-failure handling remains fail-closed. */
+export function finalText(engine, lines) {
+    const structured = finalTextFromEngine(engine, lines);
+    if (structured)
+        return structured;
+    const raw = lines.join("\n");
+    return jsonCandidates(raw).length ? raw : "";
+}
+/** The CLI's answer, with a closed diagnostic instead of a generic parsing collapse. */
+export function parseDraft(text) {
+    const candidates = jsonCandidates(text);
+    if (!candidates.length)
+        return { draft: null, validationError: "no_json_object", parseAttempts: ["fenced_json", "balanced_object"] };
+    let invalid = false;
+    for (const candidate of candidates) {
+        try {
+            const parsed = JSON.parse(candidate.text);
+            if (parsed && typeof parsed === "object" && !Array.isArray(parsed) && "status" in parsed)
+                return { draft: parsed, parseAttempts: [candidate.source] };
+        }
+        catch {
+            invalid = true;
+        }
     }
+    return { draft: null, validationError: invalid ? "invalid_json" : "not_draft_object", parseAttempts: [...new Set(candidates.map((c) => c.source))] };
 }
 /** Case, whitespace, quote-style and dash-style insensitive — so a faithful quote is never failed on typography. */
 export function normalize(s) {
@@ -117,18 +162,19 @@ const digits = (s) => s.replace(/\D/g, "");
  * Check the CLI's draft against the sources. Questions name WHAT to confirm, bounded, and are
  * returned only to the owner's own record — never to a trace.
  */
-export function checkDraft(draft, sources) {
+export function checkDraft(parsed, sources) {
+    const draft = parsed.draft;
     if (!draft)
-        return { ok: false, reason: "uncertain_claim", questions: ["The CLI did not return a readable draft. Run it again, or check the source files."], claims: 0, unmatched: 0 };
+        return { ok: false, reason: "invalid_cli_output", questions: [`The CLI did not return a readable application JSON object (${parsed.validationError ?? "unknown"}). Retry tailoring after checking the CLI output format.`], claims: 0, unmatched: 0, validationError: parsed.validationError ?? "no_json_object", parseAttempts: parsed.parseAttempts };
     if (draft.status === "needs_human") {
         const qs = (Array.isArray(draft.questions) ? draft.questions : []).filter((q) => typeof q === "string" && q.trim() !== "").map((q) => q.trim());
-        return { ok: false, reason: "missing_information", questions: qs.length ? qs : ["The CLI needs more information but did not say what."], claims: 0, unmatched: 0 };
+        return { ok: false, reason: "missing_information", questions: qs.length ? qs : ["The CLI needs more information but did not say what."], claims: 0, unmatched: 0, validationError: "incomplete_draft", parseAttempts: parsed.parseAttempts };
     }
     const resume = typeof draft.resume_markdown === "string" ? draft.resume_markdown.trim() : "";
     const coverLetter = typeof draft.cover_letter_markdown === "string" ? draft.cover_letter_markdown.trim() : "";
     const claims = Array.isArray(draft.claims) ? draft.claims : [];
     if (draft.status !== "ready" || !resume || !coverLetter || !claims.length) {
-        return { ok: false, reason: "uncertain_claim", questions: ["The draft was incomplete (missing a document or its source citations). Run it again."], claims: claims.length, unmatched: 0 };
+        return { ok: false, reason: "invalid_cli_output", questions: ["The CLI JSON was incomplete (missing a document or its source citations). Run it again."], claims: claims.length, unmatched: 0, validationError: "incomplete_draft", parseAttempts: parsed.parseAttempts };
     }
     const byRole = new Map(sources.map((s) => [s.role, normalize(s.text)]));
     const all = normalize(sources.map((s) => s.text).join("\n"));
@@ -161,6 +207,6 @@ export function checkDraft(draft, sources) {
         if (digits(p).length >= 9 && !sourceDigits.includes(digits(p)))
             flag("Confirm the phone number in the draft — it does not appear in your sources.");
     if (unmatched)
-        return { ok: false, reason: "uncertain_claim", questions, claims: claims.length, unmatched };
+        return { ok: false, reason: "uncertain_claim", questions, claims: claims.length, unmatched, validationError: "unverified_claim", parseAttempts: parsed.parseAttempts };
     return { ok: true, resume, coverLetter, claims: claims.length };
 }

package/dist/browser-runner/local-artifact/runtime.js

@@ -273,10 +273,19 @@ export class LocalArtifactRuntime {
             return;
         }
         const check = checkDraft(parseDraft(text), ctx.texts);
-        this.emit(run, { type: "claims.checked", detail: { total: check.claims, unmatched: check.ok ? 0 : check.unmatched } });
+        const retry = /:retry:(\d+)$/.exec(e.requestId);
+        const attemptNumber = retry ? Number(retry[1]) : 1;
+        const diagnostic = check.ok ? undefined : {
+            validationError: check.validationError,
+            parseAttempts: check.parseAttempts,
+            rawOutputChars: text.length,
+            runId: e.runId,
+            attemptNumber,
+        };
+        this.emit(run, { type: "claims.checked", detail: { total: check.claims, unmatched: check.ok ? 0 : check.unmatched, ...(diagnostic ? { validationError: diagnostic.validationError, parseAttempts: diagnostic.parseAttempts.join(","), rawOutputChars: diagnostic.rawOutputChars, runId: diagnostic.runId, attemptNumber } : {}) } });
         if (!check.ok) {
             this.removeIfEmpty(ctx.outDir);
-            this.pauseEnd(run, check.reason, check.questions);
+            this.pauseEnd(run, check.reason, check.questions, diagnostic);
             return;
         }
         const at = new Date(this.now()).toISOString();
@@ -340,9 +349,9 @@ export class LocalArtifactRuntime {
             return;
         run.events.push({ ...ev, at: new Date(this.now()).toISOString(), seq: ++run.seq });
     }
-    pauseEnd(run, reason, questions) {
-        this.emit(run, { type: "run.needs_human", detail: { reason, count: questions.length } });
-        this.end(run, { outcome: "needs_human", blockReason: reason, questions });
+    pauseEnd(run, reason, questions, diagnostic) {
+        this.emit(run, { type: "run.needs_human", detail: { reason, count: questions.length, ...(diagnostic ? { validationError: diagnostic.validationError, parseAttempts: diagnostic.parseAttempts.join(","), rawOutputChars: diagnostic.rawOutputChars, runId: diagnostic.runId, attemptNumber: diagnostic.attemptNumber } : {}) } });
+        this.end(run, { outcome: "needs_human", blockReason: reason, questions, diagnostic });
     }
     end(run, r) {
         if (run.state === "ended")
@@ -360,7 +369,7 @@ export class LocalArtifactRuntime {
             engineAuth: run.engineAuth,
             traceId: run.envelope.runId,
             ...(r.generatedAt ? { generatedAt: r.generatedAt } : {}),
-            ...(r.outcome === "needs_human" ? { blockReason: r.blockReason, questions: (r.questions ?? []).map((q) => redactText(q, run.secrets)) } : {}),
+            ...(r.outcome === "needs_human" ? { blockReason: r.blockReason, questions: (r.questions ?? []).map((q) => redactText(q, run.secrets)), ...(r.diagnostic ? { diagnostic: r.diagnostic } : {}) } : {}),
             // CLI output becomes this text, and a CLI prints whatever it was given: redacted before it is kept.
             ...(r.outcome === "failed" ? { error: redactText((r.error ?? "The run failed without a reason.").slice(0, 1000), run.secrets) } : {}),
         };

package/dist/browser-runner/server.js

@@ -226,6 +226,10 @@ async function route(runner, req, res) {
         return json(res, 200, runner.localArtifact.cancel(await readJson(req)));
     }
     // Local application execution (#957) — run, status, resume, cancel; PULL like research.
+    // The email-lead preflight is read-only and precedes Tailor material generation (#953).
+    if (req.method === "POST" && path === "/local-apply/preflight") {
+        return json(res, 200, await runner.localApply.preflight(await readJson(req)));
+    }
     if (req.method === "POST" && path === "/local-apply/run") {
         return json(res, 202, runner.localApply.start(await readJson(req)));
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proagentstore/cli",
-  "version": "0.4.88",
+  "version": "0.4.90",
   "description": "CLI for creating, publishing, and running ProAgentStore agents",
   "license": "MIT",
   "type": "module",