@timurtekb/tekjobs 0.24.1

package/app/dist/favicon.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64"><rect width="64" height="64" rx="12" fill="#0d1a14"/><rect x="0.5" y="0.5" width="63" height="63" rx="11.5" fill="none" stroke="#1a3326"/><text x="32" y="45" text-anchor="middle" font-family="'Bricolage Grotesque', system-ui, sans-serif" font-size="38" font-weight="700" letter-spacing="-1" fill="#c8f542">T</text></svg>

package/app/dist/index.html

@@ -0,0 +1,16 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>TekJobs</title>
+    <meta name="theme-color" content="#0d1a14" />
+    <link rel="icon" href="/favicon.svg" type="image/svg+xml" />
+    <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Bricolage+Grotesque:wght@500;600&family=Hanken+Grotesk:wght@400;500;600&family=Azeret+Mono:wght@400;500&display=swap" data-zengin="fonts" />
+    <script type="module" crossorigin src="/assets/index-QteuouKv.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-DzGgV6NF.css">
+  </head>
+  <body>
+    <div id="root"></div>
+  </body>
+</html>

package/app/server/cover-letter.mjs

@@ -0,0 +1,243 @@
+// Cover letters, written from the posting and the person's own resume.
+//
+// Two ways in, one set of rules:
+//   - The app's button runs a local LLM CLI the person is already signed in to (Claude Code by default, Codex
+//     or anything else that reads a prompt on stdin). No API key; it rides their subscription.
+//   - An agent connected over MCP asks for the same materials, writes the letter itself, and saves it.
+// Either way the letter is checked against the resume before it is kept: a figure the resume does not make is
+// flagged, because a cover letter is exactly where an eager model invents one.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import * as store from './store.mjs';
+import { CONFIG_FILE, VAULT } from '../../scraper/config.mjs';
+import { _internals as resumeCheck } from '../../scraper/resume-sync.mjs';
+
+const EMPHASES = {
+  auto: 'Choose whichever of the two emphases below the posting itself asks for, and commit to it.',
+  'design-systems': 'Lead with design systems: component architecture, tokens, accessibility gates, adoption across teams.',
+  'ai-product': 'Lead with AI product surfaces: making model behaviour legible and controllable, retrieval, evaluation, agent tooling.',
+};
+const LENGTHS = { short: [110, 170], standard: [170, 250] };
+
+// The hard constraints. Voice and shape come from the person's own Profile/Voice.md when it exists (it is
+// written into the prompt verbatim), with DEFAULT_VOICE as the fallback for a profile that has none yet.
+const RULES = `Hard rules, all binding:
+- Every fact about the candidate comes from the RESUME or PROFILE below. Do not invent employers, dates, numbers, outcomes, team sizes or technologies. A figure the resume gives may be used exactly; never rounded, never a new one.
+- Name the company in the first two sentences and write about their specific product, by name, not the category it belongs to ("Linear's site", never "a developer tool's website"). A letter that never says the company's name is a form letter and will be rejected by the checker.
+- No placeholders in brackets. With no name to address, open with "Hello,".
+- Close with the portfolio link once, exactly as the PROFILE gives it, the availability exactly as the profile states it, and the name. No sign-off word, no address block, no subject line.
+- Plain text only. No markdown, no bullets, no headings, no bold. Short paragraphs separated by blank lines.
+- No em dashes or en dashes anywhere.
+- Output the finished letter and nothing else: no preamble, no notes, no title.`;
+
+const DEFAULT_VOICE = `Voice and shape:
+- First person singular, written to a peer. Short plain sentences, one idea each, varied in length.
+- No adjectives about yourself. No "passionate", "excited", "thrilled", "strong", "deep", "leverage", "robust", "delve", "elevate", "empower".
+- Start inside their problem, in your own words: one or two sentences showing you understood what they are building and why the hard part is hard. Not a quote, not "I am writing to apply", not "for more than a decade".
+- One piece of evidence with enough detail to be believed. A second only if it is a different kind of thing. Answer what they ask for without announcing that you are answering ("You ask for X" is banned).
+- Quote the posting at most once. No "not X but Y" contrasts, no colon reveals, no rhetorical questions, no closing metaphor. End on the last concrete fact.`;
+
+const EDIT_PASS = `Process: write a draft, then edit it as a sharp human editor before you output it. In the edit, cut every sentence that could move unchanged into a letter to a different company (the portability test); break any pattern where two paragraphs open the same way or three sentences share a shape; remove every adjective the candidate applies to himself; remove any sentence that only explains the sentence before it; check every number against the RESUME; count the quotations from the posting and keep at most one. Output only the edited letter.`;
+
+/**
+ * The posting text to write from. The note's copy is a scan-time snapshot and is sometimes a stub: a few
+ * boards nest their HTML in ways the scanner flattens to one paragraph. A letter written from a stub is
+ * generic by construction, so when the copy is thin the live posting is fetched. The note is not rewritten.
+ */
+const THIN = 1500;
+const livePostings = new Map();
+async function postingText(job) {
+  const noted = job.sections.description.replace(/^>.*$/gm, '').trim();
+  if (noted.length >= THIN || !job.url) return { text: noted, source: 'note' };
+  if (!livePostings.has(job.id)) {
+    try { const r = await store.fetchLink(job.url, { maxChars: 12000 }); livePostings.set(job.id, r.status < 400 ? r.text : ''); }
+    catch { livePostings.set(job.id, ''); }
+  }
+  const live = livePostings.get(job.id);
+  return live.length > noted.length ? { text: live, source: 'live posting' } : { text: noted, source: 'note (thin, and the live posting could not be read)' };
+}
+
+/** Everything a writer needs, as one prompt. The same text goes to the CLI and to an MCP agent. */
+export async function materials(id, { emphasis = 'auto', length = 'standard', extra = '' } = {}) {
+  const job = store.getJob(id);
+  const posting = await postingText(job);
+  const packet = store.applicationPacket(id);
+  const { profile, positioning, resume } = store.profile();
+  if (!resume.trim()) throw Object.assign(new Error('No resume in the profile yet. Import one first (tekjobs resume <file>).'), { status: 409 });
+  const [lo, hi] = LENGTHS[length] || LENGTHS.standard;
+  const packetBits = ['Narrative', 'Tailored summary', 'Tailored bullets', 'Portfolio', 'Risks', 'Contact / referral']
+    .filter((f) => packet.values[f]).map((f) => `${f}: ${packet.values[f]}`).join('\n');
+  const voice = readVoice();
+  const prompt = [
+    `Write a cover letter for this job application, ${lo} to ${hi} words, in the candidate's own voice.`,
+    `Emphasis: ${EMPHASES[emphasis] || EMPHASES.auto}`,
+    extra.trim() ? `The candidate also asked: ${extra.trim()}` : '',
+    RULES,
+    voice ? `=== THE CANDIDATE'S OWN WRITING RULES AND VOICE (binding; match the register of the samples, never copy their sentences) ===\n${voice}` : DEFAULT_VOICE,
+    EDIT_PASS,
+    `=== POSTING ===\nCompany: ${job.company}\nTitle: ${job.title}\nLocation: ${job.location}\n\n${posting.text.slice(0, 9000)}`,
+    `=== WHY THE SCANNER MATCHED IT ===\n${job.sections.why}`,
+    packetBits ? `=== WHAT HAS ALREADY BEEN DECIDED FOR THIS APPLICATION ===\n${packetBits}` : '',
+    `=== RESUME (the only source of facts) ===\n${strip(resume)}`,
+    `=== PROFILE ===\n${strip(profile).slice(0, 3500)}`,
+    positioning.trim() ? `=== POSITIONING ===\n${strip(positioning).slice(0, 2500)}` : '',
+  ].filter(Boolean).join('\n\n');
+  return { id, company: job.company, title: job.title, emphasis, length, words: [lo, hi], postingSource: posting.source, postingChars: posting.text.length, prompt, rules: RULES };
+}
+const strip = (md) => md.replace(/^---\r?\n[\s\S]*?\r?\n---\r?\n?/, '').replace(/^>.*$/gm, '').trim();
+/** Profile/Voice.md: how this person writes, in their own words, with samples. Optional; the fallback is generic. */
+export function readVoice() {
+  try { return fs.readFileSync(path.join(VAULT, 'Profile', 'Voice.md'), 'utf8').replace(/^---\r?\n[\s\S]*?\r?\n---\r?\n?/, '').replace(/^> (\*\*)?The cover-letter writer reads this note.*\n/m, '').trim(); }
+  catch { return ''; }
+}
+
+/**
+ * The figures a letter asserts, each with the word it counts.
+ *
+ * Stricter than the resume differ's extractor on purpose. That one ignores one and two digit numbers, because
+ * in a resume they are mostly days of the month. In a letter they are mostly the invented ones: "a team of 40",
+ * "8 years", "3x faster". Here only a number beside a month name, or a four digit year, is treated as a date.
+ * "one" is left out: in prose it is a pronoun far more often than a count ("one I have worked on").
+ */
+const MONTH = /^(jan|feb|mar|apr|may|jun|jul|aug|sep|sept|oct|nov|dec|january|february|march|april|june|july|august|september|october|november|december)$/;
+const COUNT_WORD = /^(two|three|four|five|six|seven|eight|nine|ten|eleven|twelve|thirteen|fourteen|fifteen|twenty|thirty|forty|fifty|hundred|thousand|million|dozen)$/;
+const SKIP = new Set(['of', 'across', 'the', 'a', 'an', 'and', 'or', 'to', 'in', 'on', 'for', 'with', 'than', 'plus', 'more', 'over', 'about', 'around', 'nearly', 'up']);
+const NOT_A_NOUN = new Set(['i', 'we', 'you', 'it', 'is', 'was', 'are', 'that', 'this', 'have', 'has', 'had', 'will', 'would', 'can', 'at', 'by', 'from', 'as', 'so', 'but', 'if', 'when', 'my', 'your', 'their', 'our']);
+/** "29,000" is one number. Left alone, the comma splits it into "29" and "000" and neither means anything. */
+const ungroup = (s) => String(s).replace(/(\d),(?=\d{3}\b)/g, '$1');
+export function letterClaims(text) {
+  const out = new Set();
+  for (const line of resumeCheck.lines(ungroup(text))) {
+    const words = line.toLowerCase().replace(/[^\p{L}\p{N}%]+/gu, ' ').trim().split(' ').filter((w) => w && !SKIP.has(w));
+    words.forEach((w, i) => {
+      const figure = /^\d/.test(w) && !/^(19|20)\d\d$/.test(w);
+      if (!figure && !COUNT_WORD.test(w)) return;
+      const prev = words[i - 1] || '', next = words[i + 1] || '';
+      if (figure && (MONTH.test(prev) || MONTH.test(next))) return;          // "November 3", "3 November"
+      if (!next || NOT_A_NOUN.has(next) || /^(19|20)\d\d$/.test(next)) return;
+      out.add(`${w} ${next}`);
+    });
+  }
+  return [...out];
+}
+
+/**
+ * The patterns that make a letter read as generated. Each is a regex and the sentence a person would say about
+ * it. Drawn from the no-ai-slop editing rules and from the first letter the button produced, which opened with
+ * a decade, quoted the posting three times, and answered it in three identical "You ask for" stanzas.
+ */
+const SLOP = [
+  [/\b(for |over )?more than a decade\b|\bover a decade\b|\ba decade of\b/i, 'opens on "a decade": the sentence every applicant with ten years writes'],
+  [/\bthat is (exactly )?the (line|seam|problem|gap|work|job|role) (i|you)\b/i, 'a tag line explaining the sentence before it ("That is the line I have worked on")'],
+  [/\b(not just|not only|isn't just|is not just) \w[^.]{0,60}?\b(but|it's|it is)\b/i, 'a "not just X but Y" contrast; say Y'],
+  [/\b(isn't|is not|wasn't) (about|a matter of) [^.]{2,50}\. (it's|it is) /i, 'an "it isn\'t X, it\'s Y" contrast; say Y'],
+  [/^[^:\n]{3,60}: [a-z][^.\n]{4,}\.?$/m, 'a colon reveal ("The result: a system that lasts")'],
+  [/\b(i believe|i am confident|i would love|i look forward|thank you for (your|the) consideration|i am writing to)\b/i, 'applicant boilerplate ("I believe", "I look forward", "I am writing to")'],
+  [/\b(leverage|leveraging|robust|delve|elevate|empower|passionate|excited|thrilled|synergy|cutting-edge|ever-evolving|multifaceted|meticulous|transformative)\b/i, 'a word from the banned list'],
+  [/\b(uncompromising|relentless|meticulous|obsessive|deep (design )?sensibility|strong (visual |design )?(taste|eye|sense)|craft bar)\b/i, 'an adjective about yourself; let the facts carry it'],
+  [/\?(\s|$)/, 'a rhetorical question'],
+];
+export function slopFindings(text) {
+  const out = [];
+  for (const [re, why] of SLOP) { const m = text.match(re); if (m) out.push(`${why}: "${m[0].trim().slice(0, 60)}"`); }
+  const youAsk = (text.match(/\byou (ask|are looking|are asking|want|need|describe)\b/gi) || []).length;
+  if (youAsk >= 2) out.push(`answers the posting in ${youAsk} "You ask for" stanzas; a form, not a letter`);
+  const quotes = (text.match(/"[^"\n]{6,}"/g) || []).length;
+  if (quotes > 1) out.push(`quotes the posting ${quotes} times; once at most`);
+  const paras = text.split(/\n\s*\n/).map((p) => p.trim().split(/\s+/).slice(0, 2).join(' ').toLowerCase()).filter(Boolean);
+  const dupOpen = paras.find((p, i) => p.length > 3 && paras.indexOf(p) !== i);
+  if (dupOpen) out.push(`two paragraphs open the same way ("${dupOpen}…")`);
+  return out;
+}
+
+/** Deterministic checks on a finished letter. Warnings, never blocks: the person decides. */
+export function check(id, text) {
+  const job = store.getJob(id);
+  const { resume, profile } = store.profile();
+  // The live posting counts as a source too, when one was fetched: quoting their own number back is not inventing it.
+  const sources = `${resume}\n${profile}\n${job.sections.description}\n${livePostings.get(job.id) || ''}\n${job.company} ${job.title}`;
+  const words = text.trim() ? text.trim().split(/\s+/).length : 0;
+  const warnings = [];
+  const unsupported = letterClaims(text).filter((c) => !resumeCheck.stillClaimed(c, ungroup(sources)));
+  for (const c of unsupported) warnings.push({ kind: 'claim', text: `"${c}" is not on your resume, your profile or the posting. Check it before sending.` });
+  if (/[—–]/.test(text)) warnings.push({ kind: 'style', text: 'Contains an em or en dash. Your own rule is none in anything you send.' });
+  const ph = text.match(/\[[^\]\n]{2,40}\]/g); if (ph) warnings.push({ kind: 'placeholder', text: `Placeholder left in: ${[...new Set(ph)].join(', ')}` });
+  const cliche = ['great fit', 'perfect fit', 'dear hiring manager', 'to whom it may concern', 'fast-paced', 'team player', 'hit the ground running'].filter((p) => text.toLowerCase().includes(p));
+  if (cliche.length) warnings.push({ kind: 'style', text: `Stock phrases: ${cliche.join(', ')}.` });
+  for (const s of slopFindings(text)) warnings.push({ kind: 'slop', text: s });
+  if (!text.toLowerCase().includes(job.company.toLowerCase().split(/[ (]/)[0])) warnings.push({ kind: 'specific', text: `Never names ${job.company}. A letter that could go to anyone reads like one.` });
+  if (words > 290) warnings.push({ kind: 'length', text: `${words} words. Most readers stop near 250.` });
+  if (words && words < 90) warnings.push({ kind: 'length', text: `${words} words. Probably too thin to carry proof.` });
+  return { words, warnings };
+}
+
+export function saved(id) {
+  const text = store.getCoverLetter(id);
+  return text ? { text, ...check(id, text) } : null;
+}
+export function save(id, text, via = 'app') {
+  const clean = String(text || '').replace(/\r/g, '').trim();
+  if (clean.length < 80) throw Object.assign(new Error('That is too short to be a cover letter.'), { status: 400 });
+  store.saveCoverLetter(id, clean, via);
+  return saved(id);
+}
+
+// ---------------- the local runner ----------------
+
+/** Which CLI writes the letter. ~/.tekjobs/config.json: { "llm": { "command": "claude", "args": ["-p"] } } */
+export function runnerConfig() {
+  let cfg = {};
+  try { cfg = JSON.parse(fs.readFileSync(CONFIG_FILE, 'utf8')).llm || {}; } catch { /* none */ }
+  if (process.env.TEKJOBS_LLM_CMD) cfg = { command: process.env.TEKJOBS_LLM_CMD, args: (process.env.TEKJOBS_LLM_ARGS || '').split(' ').filter(Boolean) };
+  return { command: cfg.command || 'claude', args: cfg.args || ['-p', '--output-format', 'text'] };
+}
+
+/**
+ * @param {string} prompt          written to the CLI's stdin
+ * @param {object} [opts]
+ * @param {number} [opts.timeoutMs]
+ * @param {string[]} [opts.extraArgs]  appended after the configured args: the mail check passes tool allow and
+ *                                      deny lists here so a run can read a mailbox and nothing else
+ */
+export function runLLM(prompt, { timeoutMs = 240000, extraArgs = [] } = {}) {
+  const { command, args } = runnerConfig();
+  // An empty working directory, so the CLI does not load some project's hooks, MCP servers or instructions.
+  const cwd = path.join(os.tmpdir(), 'tekjobs-llm'); fs.mkdirSync(cwd, { recursive: true });
+  return new Promise((resolve, reject) => {
+    let out = '', err = '';
+    const child = spawn(command, [...args, ...extraArgs], { cwd, shell: true, env: process.env });   // shell: npm-installed CLIs are .cmd shims on Windows
+    const timer = setTimeout(() => { child.kill(); reject(new Error(`${command} did not answer within ${Math.round(timeoutMs / 1000)} seconds.`)); }, timeoutMs);
+    child.stdout.on('data', (d) => { out += d; });
+    child.stderr.on('data', (d) => { err += d; });
+    child.on('error', (e) => { clearTimeout(timer); reject(new Error(`Could not start "${command}": ${e.message}`)); });
+    child.on('close', (code) => {
+      clearTimeout(timer);
+      const all = `${out}\n${err}`;
+      if (/not recognized as|command not found|ENOENT/i.test(all)) return reject(Object.assign(new Error(`"${command}" is not installed or not on PATH. Install Claude Code, or set another CLI under "llm" in ${CONFIG_FILE}.`), { kind: 'missing' }));
+      if (/failed to authenticate|oauth|not logged in|please log in|login required|unauthorized|401/i.test(all)) return reject(Object.assign(new Error(`${command} is signed out. Open a terminal, run "${command}", sign in, then try again. (The desktop app's login is separate from the terminal's.)`), { kind: 'auth' }));
+      if (/requires a newer version|please upgrade/i.test(all)) return reject(Object.assign(new Error(`${command} is out of date and its model refused the request. Update it (npm i -g, or its own updater), then try again.`), { kind: 'outdated' }));
+      if (code !== 0 && !out.trim()) return reject(new Error(`${command} exited with code ${code}: ${err.trim().split('\n').slice(-2).join(' ') || 'no output'}`));
+      resolve(out.replace(/^```[a-z]*\n|\n```\s*$/g, '').trim());
+    });
+    child.stdin.write(prompt); child.stdin.end();
+  });
+}
+
+const drafts = new Map();   // id → { running, startedAt, finishedAt, error, errorKind }
+export function state(id) {
+  const d = drafts.get(id) || { running: false, startedAt: null, finishedAt: null, error: '', errorKind: '' };
+  return { ...d, saved: saved(id), runner: runnerConfig().command };
+}
+export function start(id, opts = {}) {
+  const cur = drafts.get(id);
+  if (cur?.running) return state(id);
+  store.getJob(id);   // throws early, and synchronously, if there is no such job
+  drafts.set(id, { running: true, startedAt: new Date().toISOString(), finishedAt: null, error: '', errorKind: '' });
+  materials(id, opts).then((m) => runLLM(m.prompt))
+    .then((text) => { save(id, text, `app · ${runnerConfig().command}`); drafts.set(id, { ...drafts.get(id), running: false, finishedAt: new Date().toISOString() }); })
+    .catch((e) => drafts.set(id, { ...drafts.get(id), running: false, finishedAt: new Date().toISOString(), error: e.message, errorKind: e.kind || 'failed' }));
+  return state(id);
+}
+export { VAULT };

package/app/server/index.mjs

@@ -0,0 +1,113 @@
+// TekJobs local server: JSON API over the vault + static hosting of the built app. No dependencies.
+// Dev: `npm run server` here and `npm run dev` for Vite (proxies /api). Prod: `npm start` serves dist/ and the API on one port.
+import http from 'node:http';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import * as store from './store.mjs';
+import * as letter from './cover-letter.mjs';
+import * as tailored from './tailored-resume.mjs';
+import * as mail from './mail-check.mjs';
+import * as people from './people.mjs';
+
+const PORT = Number(process.env.PORT || 8787);
+const DIST = fileURLToPath(new URL('../dist', import.meta.url));
+const MIME = { '.html': 'text/html; charset=utf-8', '.js': 'text/javascript', '.css': 'text/css', '.svg': 'image/svg+xml', '.png': 'image/png', '.ico': 'image/x-icon', '.json': 'application/json', '.woff2': 'font/woff2' };
+
+const json = (res, status, body) => { res.writeHead(status, { 'content-type': 'application/json; charset=utf-8' }); res.end(JSON.stringify(body)); };
+const readBody = (req) => new Promise((resolve, reject) => { let s = ''; req.on('data', (d) => { s += d; if (s.length > 5e6) reject(new Error('body too large')); }); req.on('end', () => { try { resolve(s ? JSON.parse(s) : {}); } catch (e) { reject(Object.assign(new Error('invalid JSON body'), { status: 400 })); } }); });
+
+const routes = [
+  ['GET', /^\/api\/summary$/, () => store.summary()],
+  ['GET', /^\/api\/today$/, (_, q) => store.today({ cap: Number(q.get('cap') || 7), waitingDays: Number(q.get('waitingDays') || 14) })],
+  ['GET', /^\/api\/jobs$/, (_, q) => store.searchJobs({ ...store.filtersFromParams(q), sort: q.get('sort') || 'score', dir: q.get('dir') || 'desc', limit: Number(q.get('limit') || 500), offset: Number(q.get('offset') || 0) })],
+  ['GET', /^\/api\/jobs\/facets$/, (_, q) => store.jobFacets(store.filtersFromParams(q))],
+  ['GET', /^\/api\/jobs\/([^/]+)\/packet$/, (m) => store.applicationPacket(decodeURIComponent(m[1]))],
+  // Cover letter: GET is the saved letter plus the draft run's state; POST starts a draft with the local CLI; PUT saves an edit.
+  ['GET', /^\/api\/jobs\/([^/]+)\/cover-letter$/, (m) => letter.state(decodeURIComponent(m[1]))],
+  ['POST', /^\/api\/jobs\/([^/]+)\/cover-letter$/, async (m, _, req) => letter.start(decodeURIComponent(m[1]), await readBody(req))],
+  // Tailored resume: same shape. The print view is served as HTML below, outside the JSON routes.
+  ['GET', /^\/api\/jobs\/([^/]+)\/resume$/, (m) => tailored.state(decodeURIComponent(m[1]))],
+  ['POST', /^\/api\/jobs\/([^/]+)\/resume$/, async (m, _, req) => tailored.start(decodeURIComponent(m[1]), await readBody(req))],
+  ['PUT', /^\/api\/jobs\/([^/]+)\/resume$/, async (m, _, req) => { const b = await readBody(req); tailored.save(decodeURIComponent(m[1]), b.text, 'app · edited by hand'); return tailored.state(decodeURIComponent(m[1])); }],
+  ['PUT', /^\/api\/jobs\/([^/]+)\/cover-letter$/, async (m, _, req) => { const b = await readBody(req); letter.save(decodeURIComponent(m[1]), b.text, 'app · edited by hand'); return letter.state(decodeURIComponent(m[1])); }],
+  ['GET', /^\/api\/jobs\/([^/]+)\/people$/, (m) => people.peopleOf(decodeURIComponent(m[1]))],
+  ['GET', /^\/api\/jobs\/([^/]+)$/, (m) => store.getJob(decodeURIComponent(m[1]))],
+  // People: one note per person under People/, linked from the job notes they are on.
+  ['GET', /^\/api\/people$/, () => people.listPeople()],
+  ['POST', /^\/api\/people$/, async (_, __, req) => { const b = await readBody(req); const p = people.createPerson(b); if (b.jobId) people.attachPerson(b.jobId, p.id, { role: b.role, context: b.context }); return people.getPerson(p.id); }],
+  ['GET', /^\/api\/people\/([^/]+)$/, (m) => people.getPerson(decodeURIComponent(m[1]))],
+  ['POST', /^\/api\/people\/([^/]+)\/attach$/, async (m, _, req) => { const b = await readBody(req); return people.attachPerson(b.jobId, decodeURIComponent(m[1]), { role: b.role, context: b.context }); }],
+  ['POST', /^\/api\/people\/([^/]+)\/log$/, async (m, _, req) => { const b = await readBody(req); return people.logContact(decodeURIComponent(m[1]), { date: b.date, via: 'app', text: b.text }); }],
+  ['PATCH', /^\/api\/jobs\/([^/]+)$/, async (m, _, req) => { const b = await readBody(req); let job; if (b.status) job = store.setStatus(decodeURIComponent(m[1]), b.status, 'app', b.reason || ''); if (b.note) job = store.addNote(decodeURIComponent(m[1]), b.note, 'app'); if (b.application) job = store.saveApplicationDraft(decodeURIComponent(m[1]), b.application); return job || store.getJob(decodeURIComponent(m[1])); }],
+  ['GET', /^\/api\/runs$/, () => store.runs()],
+  ['GET', /^\/api\/scan$/, () => store.scanStatus()],
+  ['POST', /^\/api\/scan$/, async (_, __, req) => { const b = await readBody(req); return store.runScan(b.dry ? ['--dry'] : [], { criteria: b.criteria || '', retryFailed: !!b.retryFailed, via: 'app' }); }],
+  ['GET', /^\/api\/outcomes$/, () => store.outcomes()],
+  ['GET', /^\/api\/views$/, () => store.getViews()],
+  ['GET', /^\/api\/views\/defaults$/, () => store.defaultViews()],
+  ['PUT', /^\/api\/views$/, async (_, __, req) => { const b = await readBody(req); return store.saveViews(b.views); }],
+  ['GET', /^\/api\/mail$/, () => mail.items()],
+  ['POST', /^\/api\/mail\/check$/, async (_, __, req) => mail.start(await readBody(req))],
+  ['POST', /^\/api\/mail\/confirm-safe$/, () => mail.confirmSafe()],
+  ['POST', /^\/api\/mail\/([^/]+)\/confirm$/, async (m, _, req) => mail.confirm(decodeURIComponent(m[1]), await readBody(req))],
+  ['POST', /^\/api\/mail\/([^/]+)\/dismiss$/, (m) => mail.dismiss(decodeURIComponent(m[1]))],
+  ['POST', /^\/api\/criteria\/preview$/, async (_, __, req) => { const b = await readBody(req); return store.previewCriteria(b.raw); }],
+  ['POST', /^\/api\/rescore$/, async (_, __, req) => { const b = await readBody(req); return store.rescoreNotes({ dry: !!b.dry }); }],
+  ['GET', /^\/api\/criteria\/presets$/, () => store.criteriaPresets()],
+  ['GET', /^\/api\/criteria\/presets\/([^/]+)$/, (m) => store.getCriteriaPreset(decodeURIComponent(m[1]))],
+  ['PUT', /^\/api\/criteria\/presets\/([^/]+)$/, async (m, _, req) => { const b = await readBody(req); return store.saveCriteriaPreset(decodeURIComponent(m[1]), b.raw); }],
+  ['DELETE', /^\/api\/criteria\/presets\/([^/]+)$/, (m) => store.deleteCriteriaPreset(decodeURIComponent(m[1]))],
+  ['POST', /^\/api\/criteria\/presets\/([^/]+)\/activate$/, (m) => store.activateCriteriaPreset(decodeURIComponent(m[1]))],
+  ['GET', /^\/api\/criteria$/, () => store.getCriteria()],
+  ['PUT', /^\/api\/criteria$/, async (_, __, req) => { const b = await readBody(req); return store.setCriteria(b.raw); }],
+  ['GET', /^\/api\/profile\/summary$/, () => store.profileSummary()],
+  ['GET', /^\/api\/companies$/, () => store.companies()],
+  ['GET', /^\/api\/feeds$/, () => store.feeds()],
+  ['POST', /^\/api\/companies$/, async (_, __, req) => store.addCompany(await readBody(req))],
+  ['POST', /^\/api\/jobs\/import$/, async (_, __, req) => { const b = await readBody(req); return store.importLinks(b.urls ?? b.url); }],
+  ['POST', /^\/api\/jobs\/([^/]+)\/reveal$/, (m) => store.revealJob(decodeURIComponent(m[1]))],
+  ['POST', /^\/api\/jobs\/([^/]+)\/attach$/, async (m, _, req) => { const b = await readBody(req); return store.attachPosting(decodeURIComponent(m[1]), b.url, { linkOnly: !!b.linkOnly }); }],
+  // Settings (~/.tekjobs/config.json) and the folder of resume variants.
+  ['GET', /^\/api\/settings$/, () => store.settings()],
+  ['PUT', /^\/api\/settings$/, async (_, __, req) => store.saveSettings(await readBody(req))],
+  ['GET', /^\/api\/resumes$/, () => store.listResumes()],
+  ['POST', /^\/api\/resumes\/use$/, async (_, __, req) => { const b = await readBody(req); return store.useResume(b.name); }],
+  ['POST', /^\/api\/resumes\/open$/, async (_, __, req) => { const b = await readBody(req); return store.openResume(b.name); }],
+  ['GET', /^\/api\/snippets$/, () => store.getSnippets()],
+  ['PUT', /^\/api\/snippets$/, async (_, __, req) => { const b = await readBody(req); return store.saveSnippets(b.items); }],
+  ['GET', /^\/api\/profile$/, () => store.profile()],
+  ['PUT', /^\/api\/profile$/, async (_, __, req) => { const b = await readBody(req); return store.saveProfileNote(b.note || 'profile', b.markdown); }],
+  ['GET', /^\/api\/onboarding$/, () => store.onboardingStatus()],
+  ['POST', /^\/api\/onboarding\/init$/, () => store.initProfile()],
+  ['POST', /^\/api\/onboarding\/resume$/, async (_, __, req) => { const b = await readBody(req); return store.importResume(b.path); }],
+  ['GET', /^\/api\/statuses$/, () => store.STATUSES],
+  ['GET', /^\/api\/pass-reasons$/, () => store.PASS_REASONS],
+  ['GET', /^\/api\/application-fields$/, () => store.APPLICATION_FIELDS],
+];
+
+function serveStatic(req, res, pathname) {
+  if (!fs.existsSync(DIST)) { res.writeHead(503, { 'content-type': 'text/plain' }); return res.end('No build yet. Run `npm run build`, or use `npm run dev` for the Vite dev server.'); }
+  let file = path.join(DIST, decodeURIComponent(pathname));
+  if (!file.startsWith(DIST)) { res.writeHead(403); return res.end(); }
+  if (!fs.existsSync(file) || fs.statSync(file).isDirectory()) file = path.join(DIST, 'index.html');
+  res.writeHead(200, { 'content-type': MIME[path.extname(file)] || 'application/octet-stream' });
+  fs.createReadStream(file).pipe(res);
+}
+
+const server = http.createServer(async (req, res) => {
+  const url = new URL(req.url, `http://${req.headers.host || 'localhost'}`);
+  try {
+    const printView = url.pathname.match(/^\/api\/jobs\/([^/]+)\/resume\.html$/);
+    if (printView && req.method === 'GET') { res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' }); return res.end(tailored.html(decodeURIComponent(printView[1]))); }
+    for (const [method, re, handler] of routes) {
+      const m = url.pathname.match(re);
+      if (m && req.method === method) return json(res, 200, await handler(m, url.searchParams, req));
+    }
+    if (url.pathname.startsWith('/api/')) return json(res, 404, { error: `no route ${req.method} ${url.pathname}` });
+    return serveStatic(req, res, url.pathname);
+  } catch (e) {
+    return json(res, e.status || 500, { error: e.message });
+  }
+});
+server.listen(PORT, '127.0.0.1', () => console.log(`TekJobs server  http://127.0.0.1:${PORT}  vault: ${store.VAULT}`));

package/app/server/mail-check.mjs

@@ -0,0 +1,234 @@
+// The response loop: what the mailbox says about the applications, reconciled with the notes.
+//
+// The same local CLI that writes the letters reads the mail, through the Gmail connector the person has
+// already attached to it. The run is boxed: only the three Gmail read tools are allowed and every write tool
+// (send, reply, draft, label, trash, forward) plus Bash/Write/Edit are denied by name, so a run can read and
+// nothing else, whatever the model decides. The model's job is extraction into a fixed JSON shape; matching
+// those entries to notes, and everything that changes a note, is deterministic code here, and nothing changes
+// until a person confirms an item. Applied, interviewing and offer stay human statuses; so does rejected,
+// because a wrong "rejected" is the one a person would mind most.
+import fs from 'node:fs';
+import path from 'node:path';
+import { DATA_DIR, loadCriteria } from '../../scraper/config.mjs';
+import { writeJobNote } from '../../scraper/vault.mjs';
+import { scoreJob } from '../../scraper/score.mjs';
+import { htmlToText } from '../../scraper/sources.mjs';
+import * as store from './store.mjs';
+import * as people from './people.mjs';
+import { runLLM, runnerConfig } from './cover-letter.mjs';
+
+const FILE = path.join(DATA_DIR, 'mail-check.json');
+const READ_TOOLS = ['mcp__claude_ai_Gmail__search_threads', 'mcp__claude_ai_Gmail__get_thread', 'mcp__claude_ai_Gmail__get_message'];
+const DENY_TOOLS = ['send_message', 'reply', 'forward', 'create_draft', 'update_draft', 'send_draft', 'delete_draft', 'trash_message', 'trash_thread', 'untrash_message', 'untrash_thread', 'label_message', 'label_thread', 'unlabel_message', 'unlabel_thread', 'update_message_labels', 'create_label', 'update_label', 'delete_label', 'mark_message_spam', 'mark_thread_spam', 'unmark_message_spam', 'unmark_thread_spam', 'apply_sensitive_message_label', 'apply_sensitive_thread_label']
+  .map((t) => `mcp__claude_ai_Gmail__${t}`).concat(['Bash', 'Write', 'Edit', 'MultiEdit', 'NotebookEdit', 'WebFetch', 'WebSearch']);
+export const KINDS = ['confirmation', 'rejection', 'advance', 'scheduling', 'info-request', 'other'];
+const SEARCHES = [
+  'from:greenhouse.io', 'from:ashbyhq.com', 'from:lever.co OR from:hire.lever.co', 'from:myworkdayjobs.com OR from:workday.com', 'from:smartrecruiters.com OR from:jobvite.com OR from:icims.com OR from:workablemail.com OR from:rippling.com',
+  'subject:("your application" OR "thank you for applying" OR "thanks for applying" OR "application received" OR "application update" OR "next steps" OR "not moving forward" OR interview)',
+];
+const gmailLink = (id) => `https://mail.google.com/mail/u/0/#all/${id}`;
+
+function load() { try { return JSON.parse(fs.readFileSync(FILE, 'utf8')); } catch { return { lastRun: null, sinceDays: null, items: [] }; } }
+function persist(d) { fs.mkdirSync(DATA_DIR, { recursive: true }); fs.writeFileSync(FILE, JSON.stringify(d, null, 2)); }
+
+/** The extraction prompt. The companies list is a hint for recognition, not a filter: mail about others is still reported. */
+export function prompt({ sinceDays = 21, companies = [] } = {}) {
+  return `You are checking a job seeker's mailbox for updates about job applications. Use ONLY the Gmail search and read tools. Do not send, reply, draft, label, forward, trash or modify anything.
+
+Run these searches, each with newer_than:${sinceDays}d appended, then stop:
+${SEARCHES.map((s, i) => `${i + 1}. ${s} newer_than:${sinceDays}d`).join('\n')}
+
+Search results already carry subject, sender, date and a snippet. Decide from those. Read a thread only when the subject and snippet do not say whether the message is a confirmation of receipt, a rejection, or an advance (an interview, a screen, a scheduling request). Do not read threads that are plainly confirmations.
+
+Report every message that is about one of the person's job applications: confirmations of receipt, rejections, invitations to interview or to schedule, requests to complete or add to an application. Ignore job alerts, newsletters, recruiter cold outreach, and anything not tied to an application the person made.${companies.length ? `
+
+The person's own records show applications at these companies (others may exist): ${companies.join(', ')}.` : ''}
+
+Output ONLY a JSON array, no prose, no code fence, one object per message:
+{"company": "company name as the email gives it", "role": "role title if stated, else empty string", "kind": "confirmation|rejection|advance|scheduling|info-request|other", "date": "YYYY-MM-DD", "gist": "one plain sentence", "from": "sender address", "fromName": "the sender's display name, or the name a person signed with if you read the message; empty for automated senders", "messageId": "gmail message id", "subject": "subject line"}
+
+If nothing matches, output [].`;
+}
+
+/** The model's text into clean entries, or an error that says what came back. */
+export function parseOutput(text) {
+  const s = String(text || '');
+  const a = s.indexOf('['), b = s.lastIndexOf(']');
+  if (a < 0 || b < a) throw new Error(`The runner returned no JSON array. It said: ${s.slice(0, 200).replace(/\s+/g, ' ')}`);
+  let arr; try { arr = JSON.parse(s.slice(a, b + 1)); } catch (e) { throw new Error(`The runner's JSON did not parse: ${e.message}`); }
+  if (!Array.isArray(arr)) throw new Error('The runner returned JSON that is not an array.');
+  return arr.filter((m) => m && typeof m === 'object' && m.company && m.messageId).map((m) => ({
+    company: String(m.company).trim(), role: String(m.role || '').trim(), kind: KINDS.includes(m.kind) ? m.kind : 'other',
+    date: /^\d{4}-\d{2}-\d{2}$/.test(String(m.date || '')) ? m.date : '', gist: String(m.gist || '').trim().slice(0, 300),
+    from: String(m.from || '').trim(), fromName: String(m.fromName || '').trim().slice(0, 80), messageId: String(m.messageId).trim(), subject: String(m.subject || '').trim().slice(0, 200),
+  }));
+}
+
+const norm = (s) => String(s || '').toLowerCase().replace(/\(.*?\)|\[.*?\]/g, '').replace(/\b(inc|llc|ltd|corp|co|the)\b/g, '').replace(/[^a-z0-9]+/g, ' ').trim();
+const APPLIED_ISH = new Set(['applying', 'ready', 'applied', 'interviewing', 'offer', 'rejected']);
+const OPEN_ISH = new Set(['new', 'reviewing', 'applying', 'ready']);
+
+/** What confirming an entry would do to its note. Pure, so it can be tested. */
+export function suggestionFor(kind, noteStatus, date) {
+  if (!noteStatus) return { action: 'create', status: kind === 'rejection' ? 'rejected' : kind === 'advance' || kind === 'scheduling' ? 'interviewing' : 'applied', appliedOn: date };
+  if (kind === 'confirmation') return OPEN_ISH.has(noteStatus) ? { action: 'status', status: 'applied', appliedOn: date } : { action: 'record', appliedOn: date };
+  if (kind === 'rejection') return noteStatus === 'rejected' ? { action: 'record' } : { action: 'status', status: 'rejected' };
+  if (kind === 'advance' || kind === 'scheduling') return ['interviewing', 'offer'].includes(noteStatus) ? { action: 'record' } : { action: 'status', status: 'interviewing' };
+  return { action: 'record' };
+}
+
+/**
+ * Match mail entries to notes: same company by name, the exact role when the title matches, otherwise the
+ * note that is furthest along, with the other candidates listed so a person can pick. Pure.
+ */
+export function reconcile(mails, notes) {
+  const byCompany = new Map();
+  for (const n of notes) { const k = norm(n.company); if (!k) continue; if (!byCompany.has(k)) byCompany.set(k, []); byCompany.get(k).push(n); }
+  const rank = (n) => (APPLIED_ISH.has(n.status) ? 2 : n.status === 'reviewing' ? 1 : 0);
+  return mails.map((m) => {
+    const key = norm(m.company);
+    let cands = byCompany.get(key) || [];
+    if (!cands.length && key) cands = [...byCompany.entries()].filter(([k]) => k.startsWith(key + ' ') || key.startsWith(k + ' ')).flatMap(([, v]) => v);
+    const exact = m.role ? cands.find((n) => norm(n.title) === norm(m.role)) : null;
+    const byRank = [...cands].sort((a, b) => rank(b) - rank(a) || (b.score || 0) - (a.score || 0));
+    // An email that names a role the vault does not have is a different application, not the note that
+    // happens to share the company: default to a new note and offer the company's notes as a pick. (Learned
+    // on the first real run, when a Staff Product Designer confirmation landed on an Engineering Manager note.)
+    const otherRole = !exact && m.role && cands.length > 0;
+    const best = exact || (otherRole ? null : byRank[0] || null);
+    const match = exact ? 'exact' : otherRole ? 'company-other-role' : best ? 'company' : 'none';
+    return {
+      id: m.messageId, ...m, match,
+      noteId: best ? best.id : '', noteTitle: best ? best.title : '', noteStatus: best ? best.status : '',
+      candidates: byRank.slice(0, 6).map((n) => ({ id: n.id, title: n.title, status: n.status })),
+      suggestion: suggestionFor(m.kind, best ? best.status : '', m.date),
+      // The human who wrote, if one did; confirming puts them on the note and in People.
+      person: people.fromMail(m),
+      state: 'pending',
+    };
+  });
+}
+
+// ---------------- grouping ----------------
+// One application produces several emails (a confirmation, then scheduling mail, then a decision), and the
+// mailbox holds each one. A person decides once per application, so pending items are grouped by company and
+// role; the strongest kind speaks for the group and the rest are recorded with it when it is confirmed.
+const STRENGTH = { rejection: 5, advance: 4, scheduling: 4, 'info-request': 2, confirmation: 1, other: 0 };
+export function groupItems(items) {
+  const groups = new Map();
+  for (const i of items.filter((x) => x.state === 'pending')) {
+    const key = `${norm(i.company)}|${norm(i.role)}`;
+    if (!groups.has(key)) groups.set(key, []);
+    groups.get(key).push(i);
+  }
+  return [...groups.values()].map((members) => {
+    const sorted = [...members].sort((a, b) => (STRENGTH[b.kind] - STRENGTH[a.kind]) || (b.date || '').localeCompare(a.date || ''));
+    const rep = sorted[0];
+    return {
+      id: rep.id, ids: sorted.map((m) => m.id), count: members.length,
+      company: rep.company, role: rep.role || sorted.find((m) => m.role)?.role || '',
+      kind: rep.kind, kinds: [...new Set(sorted.map((m) => m.kind))], date: sorted.map((m) => m.date).sort().pop() || '',
+      first: sorted.map((m) => m.date).filter(Boolean).sort()[0] || '',
+      gist: rep.gist, subject: rep.subject, from: rep.from,
+      person: rep.person || sorted.find((m) => m.person)?.person || null,
+      match: rep.match, noteId: rep.noteId, noteTitle: rep.noteTitle, noteStatus: rep.noteStatus, candidates: rep.candidates, suggestion: rep.suggestion,
+    };
+  }).sort((a, b) => (STRENGTH[b.kind] - STRENGTH[a.kind]) || b.date.localeCompare(a.date));
+}
+
+// ---------------- running ----------------
+const run = { running: false, startedAt: null, finishedAt: null, error: '', errorKind: '', sinceDays: null };
+export function items() {
+  const d = load();
+  const all = d.items || [];
+  return { ...run, runner: runnerConfig().command, lastRun: d.lastRun, lastSinceDays: d.sinceDays, items: all, groups: groupItems(all) };
+}
+export function start({ sinceDays } = {}) {
+  if (run.running) return items();
+  const d = load();
+  // Default window: since the last check plus a day of overlap, or three weeks the first time.
+  const days = Number(sinceDays) || (d.lastRun ? Math.max(2, Math.ceil((Date.now() - Date.parse(d.lastRun)) / 864e5) + 1) : 21);
+  Object.assign(run, { running: true, startedAt: new Date().toISOString(), finishedAt: null, error: '', errorKind: '', sinceDays: days });
+  const notes = store.listJobs();
+  const companies = [...new Set(notes.filter((n) => APPLIED_ISH.has(n.status)).map((n) => n.company))].sort();
+  runLLM(prompt({ sinceDays: days, companies }), { timeoutMs: 15 * 60 * 1000, extraArgs: ['--allowedTools', ...READ_TOOLS, '--disallowedTools', ...DENY_TOOLS] })
+    .then((text) => {
+      const fresh = reconcile(parseOutput(text), store.listJobs());
+      const cur = load();
+      const known = new Map((cur.items || []).map((i) => [i.id, i]));
+      // A message already confirmed or dismissed keeps that state; everything else is re-matched against today's notes.
+      const merged = fresh.map((i) => { const k = known.get(i.id); return k && k.state !== 'pending' ? { ...k, ...i, state: k.state, resolved: k.resolved } : i; });
+      for (const k of known.values()) if (!merged.some((i) => i.id === k.id)) merged.push(k);   // older windows stay
+      merged.sort((a, b) => (b.date || '').localeCompare(a.date || ''));
+      persist({ lastRun: new Date().toISOString(), sinceDays: days, items: merged });
+      Object.assign(run, { running: false, finishedAt: new Date().toISOString() });
+    })
+    .catch((e) => Object.assign(run, { running: false, finishedAt: new Date().toISOString(), error: e.message, errorKind: e.kind || 'failed' }));
+  return items();
+}
+
+// ---------------- confirming ----------------
+const mailLine = (i) => `Mail, ${i.date || 'undated'} (${i.kind}): ${i.gist} [message](${gmailLink(i.messageId)})`;
+
+function appliedOnEmpty(id) {
+  try { return /^- \*\*Applied on:\*\*\s*$/m.test(fs.readFileSync(store.getJob(id).path, 'utf8')); } catch { return false; }
+}
+
+/**
+ * Do what the group's strongest email suggests, to the note the person chose (or the matched one), record
+ * every email in the group on that note, and mark them all confirmed.
+ */
+export function confirm(id, { noteId } = {}) {
+  const d = load();
+  const group = groupItems(d.items || []).find((g) => g.ids.includes(id));
+  const item = (d.items || []).find((i) => i.id === (group ? group.id : id));
+  if (!item) throw Object.assign(new Error(`No mail item ${id}`), { status: 404 });
+  const members = (d.items || []).filter((i) => (group ? group.ids : [id]).includes(i.id));
+  // The earliest confirmation in the group is the application date; the strongest email decides the status.
+  const appliedOn = members.filter((m) => m.kind === 'confirmation' && m.date).map((m) => m.date).sort()[0] || item.date;
+  let target = noteId || item.noteId;
+  const s = target ? suggestionFor(item.kind, store.getJob(target).status, appliedOn) : suggestionFor(item.kind, '', appliedOn);
+  if (!target) {
+    if (s.action !== 'create') throw Object.assign(new Error('This entry matched no note; pick one or create one.'), { status: 400 });
+    const criteria = loadCriteria();
+    const job = { id: `mail:${item.messageId}`, source: 'mail', company: item.company, title: item.role || 'Role not stated in the email', url: gmailLink(item.messageId), location: '', remote: false, posted: item.date || null, salary: '', department: '', employmentType: '',
+      descriptionHtml: `<p>Created from an application email (${item.kind}, ${item.date || 'undated'}): ${item.gist}</p><p>Subject: ${item.subject}</p><p>From: ${item.from}</p>`, foundVia: 'created from an application email', addedBy: 'mail' };
+    job.descriptionText = htmlToText(job.descriptionHtml);
+    const file = writeJobNote(job, scoreJob(job, criteria), criteria);
+    target = path.basename(file, '.md');
+    store.cacheClear?.();
+  }
+  if (s.action === 'status' || s.action === 'create') store.setStatus(target, s.status, 'app');
+  if (appliedOn && members.some((m) => m.kind === 'confirmation') && appliedOnEmpty(target)) store.saveApplicationDraft(target, { field: 'Applied on', value: appliedOn });
+  // Oldest first, so the note's Notes read in the order the mail arrived.
+  for (const m of [...members].sort((a, b) => (a.date || '').localeCompare(b.date || ''))) store.addNote(target, mailLine(m), 'app');
+  // The humans who wrote go on the note's People and get the mail on their own Log; machines do not.
+  const persons = [...new Set(members.map((m) => { try { return people.recordFromMail(target, m, gmailLink(m.messageId)); } catch { return null; } }).filter(Boolean))];
+  const at = new Date().toISOString();
+  for (const m of members) { m.state = 'confirmed'; m.noteId = target; m.resolved = { at, action: s.action, status: s.status || '', persons }; }
+  persist(d);
+  return items();
+}
+/**
+ * The safe set in one go: confirmations whose note matched by exact title. Each one either records the mail on
+ * a note already marked applied or marks a still-open note applied as of the mail's date. Rejections, interview
+ * signals, company-only matches and creates are left for one-at-a-time, since those deserve a look.
+ */
+export function safeGroups() {
+  return groupItems(load().items || []).filter((g) => g.kind === 'confirmation' && g.match === 'exact' && g.noteId);
+}
+export function confirmSafe() {
+  const done = [];
+  for (const g of safeGroups()) { try { confirm(g.id); done.push(g.id); } catch { /* the next group still gets its turn */ } }
+  return { confirmed: done.length, ...items() };
+}
+export function dismiss(id) {
+  const d = load();
+  const group = groupItems(d.items || []).find((g) => g.ids.includes(id));
+  const members = (d.items || []).filter((i) => (group ? group.ids : [id]).includes(i.id));
+  if (!members.length) throw Object.assign(new Error(`No mail item ${id}`), { status: 404 });
+  const at = new Date().toISOString();
+  for (const m of members) { m.state = 'dismissed'; m.resolved = { at, action: 'dismissed' }; }
+  persist(d);
+  return items();
+}