careermate 0.1.0 → 0.1.2

package/apps/web/public/styles.css

@@ -19,24 +19,24 @@
 }
 
 :root {
-  /* Neutral palette (light) */
-  --bg: #ffffff;
-  --bg-subtle: #f7f7f8;
-  --bg-sunken: #f1f1f3;
+  /* Warm paper neutrals (light) — unified with the public landing page */
+  --bg: #faf8f4;
+  --bg-subtle: #f2efe8;
+  --bg-sunken: #ece8df;
   --surface: #ffffff;
-  --surface-hover: #f7f7f8;
-  --border: #e6e6e9;
-  --border-strong: #d4d4d8;
-  --text: #1c1c1f;
-  --text-secondary: #5c5c66;
-  --text-tertiary: #8a8a94;
+  --surface-hover: #f5f2ec;
+  --border: #e6e1d6;
+  --border-strong: #d6d0c2;
+  --text: #1c1a16;
+  --text-secondary: #595449;
+  --text-tertiary: #8b867a;
   --text-on-accent: #ffffff;
 
-  /* Accent — calm indigo */
-  --accent: #4f46e5;
-  --accent-hover: #4338ca;
-  --accent-soft: #eef2ff;
-  --accent-border: #c7d2fe;
+  /* Accent — deep emerald (single flat accent, no gradient) */
+  --accent: #0f7256;
+  --accent-hover: #0b5b44;
+  --accent-soft: #e7f1ec;
+  --accent-border: #bcdccd;
 
   /* Semantic */
   --green: #15803d;     --green-soft: #ecfdf3;  --green-border: #bbf7d0;
@@ -67,31 +67,38 @@
 
 @media (prefers-color-scheme: dark) {
   :root:not([data-theme='light']) {
-    --bg: #161618;
-    --bg-subtle: #1d1d20;
-    --bg-sunken: #0f0f11;
-    --surface: #1d1d20;
-    --surface-hover: #26262a;
-    --border: #2c2c31;
-    --border-strong: #3a3a41;
-    --text: #ededf0;
-    --text-secondary: #a5a5b0;
-    --text-tertiary: #74747e;
-    --accent: #818cf8;
-    --accent-hover: #a5b4fc;
-    --accent-soft: #1e1b3a;
-    --accent-border: #3730a3;
+    --bg: #14130f;
+    --bg-subtle: #201d17;
+    --bg-sunken: #100f0b;
+    --surface: #1b1915;
+    --surface-hover: #262219;
+    --border: #2e2a22;
+    --border-strong: #3e3930;
+    --text: #f2eee5;
+    --text-secondary: #aaa599;
+    --text-tertiary: #79746a;
+    --accent: #34d399;
+    --accent-hover: #6ee7b7;
+    --accent-soft: #11281d;
+    --accent-border: #1f4f3c;
+    --text-on-accent: #05241a;
     --green-soft:#0e2a1a; --teal-soft:#0c2826; --blue-soft:#11203f; --violet-soft:#1e1638;
     --amber-soft:#2a2008; --red-soft:#2c1414; --slate-soft:#1f242b;
+    /* lighter semantic foregrounds so status badges stay legible on dark soft bg */
+    --green:#4ade80; --teal:#2dd4bf; --blue:#60a5fa; --violet:#a78bfa; --amber:#fbbf24; --red:#ef4444; --slate:#94a3b8;
+    --green-border:#1f4f3c; --teal-border:#155e57; --blue-border:#1e3a6b; --violet-border:#3b2f6b; --amber-border:#5c4410; --red-border:#5c2020; --slate-border:#3a4250;
     --shadow-lg: 0 12px 40px rgba(0,0,0,.5);
   }
 }
 :root[data-theme='dark'] {
-  --bg:#161618; --bg-subtle:#1d1d20; --bg-sunken:#0f0f11; --surface:#1d1d20; --surface-hover:#26262a;
-  --border:#2c2c31; --border-strong:#3a3a41; --text:#ededf0; --text-secondary:#a5a5b0; --text-tertiary:#74747e;
-  --accent:#818cf8; --accent-hover:#a5b4fc; --accent-soft:#1e1b3a; --accent-border:#3730a3;
+  --bg:#14130f; --bg-subtle:#201d17; --bg-sunken:#100f0b; --surface:#1b1915; --surface-hover:#262219;
+  --border:#2e2a22; --border-strong:#3e3930; --text:#f2eee5; --text-secondary:#aaa599; --text-tertiary:#79746a;
+  --accent:#34d399; --accent-hover:#6ee7b7; --accent-soft:#11281d; --accent-border:#1f4f3c; --text-on-accent:#05241a;
   --green-soft:#0e2a1a; --teal-soft:#0c2826; --blue-soft:#11203f; --violet-soft:#1e1638;
-  --amber-soft:#2a2008; --red-soft:#2c1414; --slate-soft:#1f242b; --shadow-lg:0 12px 40px rgba(0,0,0,.5);
+  --amber-soft:#2a2008; --red-soft:#2c1414; --slate-soft:#1f242b;
+  --green:#4ade80; --teal:#2dd4bf; --blue:#60a5fa; --violet:#a78bfa; --amber:#fbbf24; --red:#ef4444; --slate:#94a3b8;
+  --green-border:#1f4f3c; --teal-border:#155e57; --blue-border:#1e3a6b; --violet-border:#3b2f6b; --amber-border:#5c4410; --red-border:#5c2020; --slate-border:#3a4250;
+  --shadow-lg:0 12px 40px rgba(0,0,0,.5);
 }
 
 * { box-sizing: border-box; }
@@ -120,7 +127,7 @@ h1,h2,h3,h4 { margin: 0; font-weight: 650; letter-spacing: -0.01em; }
 .sidebar__logo {
   width: 30px; height: 30px; border-radius: 8px; flex: none;
   background: var(--accent);
-  display: grid; place-items: center; color: #fff; font-weight: 800; font-size: 15px;
+  display: grid; place-items: center; color: var(--text-on-accent); font-weight: 800; font-size: 15px;
 }
 .sidebar__title { font-weight: 700; font-size: 15px; letter-spacing: -.01em; }
 .sidebar__subtitle { font-size: 12px; color: var(--text-tertiary); margin-top: 1px; }
@@ -135,7 +142,7 @@ h1,h2,h3,h4 { margin: 0; font-weight: 650; letter-spacing: -0.01em; }
 .nav__item svg { width: 17px; height: 17px; flex: none; }
 .nav__badge { margin-left: auto; font-size: 11.5px; background: var(--bg-sunken); color: var(--text-secondary);
   padding: 1px 7px; border-radius: 999px; font-weight: 600; }
-.nav__item.is-active .nav__badge { background: var(--accent); color: #fff; }
+.nav__item.is-active .nav__badge { background: var(--accent); color: var(--text-on-accent); }
 .sidebar__foot { padding: 12px 16px; border-top: 1px solid var(--border); font-size: 12px; color: var(--text-tertiary); }
 .sidebar__foot .dot { display:inline-block; width:7px; height:7px; border-radius:999px; background: var(--green); margin-right:6px; }
 
@@ -148,6 +155,13 @@ h1,h2,h3,h4 { margin: 0; font-weight: 650; letter-spacing: -0.01em; }
 .topbar__title { font-size: 15px; font-weight: 650; }
 .topbar__crumb { color: var(--text-tertiary); }
 .topbar__spacer { flex: 1; }
+/* mobile nav: hamburger (hidden ≥900px) + off-canvas drawer scrim */
+.nav-toggle { display: none; width: 34px; height: 34px; flex: none; place-items: center;
+  border: 1px solid var(--border); background: var(--surface); border-radius: var(--radius-sm);
+  color: var(--text-secondary); cursor: pointer; margin-right: 4px; }
+.nav-toggle:hover { background: var(--surface-hover); color: var(--text); }
+.nav-toggle svg { width: 20px; height: 20px; }
+.nav-scrim { display: none; position: fixed; inset: 0; z-index: 40; background: rgba(0,0,0,.4); }
 .view { padding: 24px; max-width: var(--maxw); width: 100%; margin: 0 auto; }
 .view--wide { max-width: 1280px; }
 
@@ -161,7 +175,16 @@ h1,h2,h3,h4 { margin: 0; font-weight: 650; letter-spacing: -0.01em; }
 .grid--2 { grid-template-columns: repeat(2, 1fr); }
 .grid--3 { grid-template-columns: repeat(3, 1fr); }
 .grid--4 { grid-template-columns: repeat(4, 1fr); }
-@media (max-width: 900px){ .grid--2,.grid--3,.grid--4{ grid-template-columns: 1fr; } .app{ grid-template-columns: 1fr; } .sidebar{ display:none; } }
+@media (max-width: 900px){
+  .grid--2,.grid--3,.grid--4{ grid-template-columns: 1fr; }
+  .app{ grid-template-columns: 1fr; }
+  /* sidebar slides in as an off-canvas drawer; the topbar hamburger toggles it */
+  .sidebar{ position: fixed; top: 0; left: 0; bottom: 0; height: 100%; z-index: 50;
+    transform: translateX(-100%); transition: transform .22s ease; box-shadow: var(--shadow-lg); }
+  .app.nav-open .sidebar{ transform: none; }
+  .app.nav-open .nav-scrim{ display: block; }
+  .nav-toggle{ display: inline-grid; }
+}
 
 /* ----------------------------------------------------------------- card */
 .card { background: var(--surface); border: 1px solid var(--border); border-radius: var(--radius-lg); box-shadow: var(--shadow-sm); }
@@ -184,6 +207,12 @@ h1,h2,h3,h4 { margin: 0; font-weight: 650; letter-spacing: -0.01em; }
 .stat__label svg { width: 15px; height: 15px; color: var(--text-tertiary); }
 .stat__value { font-size: 26px; font-weight: 700; letter-spacing: -.02em; margin-top: 6px; }
 .stat__hint { font-size: 12.5px; color: var(--text-tertiary); margin-top: 2px; }
+/* borderless count strip (settings 내 데이터) — flat counts, never a card-in-card */
+.countstrip { display: grid; grid-template-columns: repeat(3, 1fr); gap: 18px 24px; }
+.countstrip__item { display: flex; flex-direction: column; gap: 2px; }
+.countstrip__num { font-size: 24px; font-weight: 700; letter-spacing: -.02em; }
+.countstrip__label { font-size: 13px; color: var(--text-secondary); }
+@media (max-width: 560px){ .countstrip { grid-template-columns: repeat(2, 1fr); } }
 
 /* ----------------------------------------------------------------- buttons */
 .btn {
@@ -195,7 +224,7 @@ h1,h2,h3,h4 { margin: 0; font-weight: 650; letter-spacing: -0.01em; }
 .btn:hover { background: var(--surface-hover); }
 .btn:disabled { opacity: .5; cursor: not-allowed; }
 .btn svg { width: 15px; height: 15px; }
-.btn--primary { background: var(--accent); border-color: var(--accent); color: #fff; }
+.btn--primary { background: var(--accent); border-color: var(--accent); color: var(--text-on-accent); }
 .btn--primary:hover { background: var(--accent-hover); border-color: var(--accent-hover); }
 .btn--ghost { border-color: transparent; background: transparent; }
 .btn--ghost:hover { background: var(--surface-hover); }
@@ -216,7 +245,14 @@ h1,h2,h3,h4 { margin: 0; font-weight: 650; letter-spacing: -0.01em; }
   background: var(--surface); border: 1px solid var(--border-strong); border-radius: var(--radius-sm);
   padding: 8px 11px; transition: border-color .12s, box-shadow .12s;
 }
-.input:focus, .textarea:focus, .select:focus { outline: none; border-color: var(--accent); box-shadow: 0 0 0 3px var(--accent-soft); }
+.input:focus, .textarea:focus, .select:focus { border-color: var(--accent); box-shadow: 0 0 0 3px var(--accent-soft); }
+/* keyboard focus must be clearly visible (the soft ring alone fails WCAG 1.4.11/2.4.11) */
+.input:focus-visible, .textarea:focus-visible, .select:focus-visible { outline: 2px solid var(--accent); outline-offset: 1px; box-shadow: none; }
+/* skip link — hidden until focused, then drops into the top-left */
+.skip-link { position: fixed; top: 8px; left: 8px; z-index: 200; transform: translateY(-200%);
+  background: var(--accent); color: var(--text-on-accent); padding: 8px 14px; border: 0;
+  border-radius: var(--radius-sm); font: inherit; font-weight: 600; cursor: pointer; transition: transform .15s; }
+.skip-link:focus { transform: none; outline: 2px solid var(--text-on-accent); outline-offset: 2px; }
 .textarea { resize: vertical; min-height: 90px; line-height: 1.6; }
 .textarea--lg { min-height: 280px; font-size: 15px; }
 .input::placeholder, .textarea::placeholder { color: var(--text-tertiary); }
@@ -255,6 +291,9 @@ h1,h2,h3,h4 { margin: 0; font-weight: 650; letter-spacing: -0.01em; }
 .table tbody tr.is-clickable:hover { background: var(--surface-hover); }
 .table .muted { color: var(--text-tertiary); }
 .table .strong { font-weight: 600; }
+/* keyboard-reachable lead-cell link that looks identical to plain text */
+.cell-link { color: inherit; text-decoration: none; }
+.cell-link:hover { text-decoration: none; }
 
 /* ----------------------------------------------------------------- progress */
 .progress { height: 7px; background: var(--bg-sunken); border-radius: 999px; overflow: hidden; }
@@ -377,6 +416,9 @@ h1,h2,h3,h4 { margin: 0; font-weight: 650; letter-spacing: -0.01em; }
 .modal__head { padding: 16px 20px; border-bottom: 1px solid var(--border); display: flex; align-items: center; }
 .modal__head h3 { font-size: 15px; }
 .modal__body { padding: 20px; overflow-y: auto; }
+.modal__error { margin: 0 20px 4px; padding: 10px 12px; border-radius: var(--radius); border: 1px solid var(--red-border);
+  background: var(--red-soft); color: var(--red); font-size: 13px; line-height: 1.5; }
+.modal__error[hidden] { display: none; }
 .modal__foot { padding: 14px 20px; border-top: 1px solid var(--border); display: flex; justify-content: flex-end; gap: 8px; }
 @keyframes pop { from { transform: translate(-50%,-46%); opacity: 0; } to { transform: translate(-50%,-50%); opacity: 1; } }
 @keyframes fade { from { opacity: 0; } to { opacity: 1; } }
@@ -413,6 +455,7 @@ h1,h2,h3,h4 { margin: 0; font-weight: 650; letter-spacing: -0.01em; }
 .skeleton { background: linear-gradient(90deg, var(--bg-sunken) 25%, var(--surface-hover) 37%, var(--bg-sunken) 63%); background-size: 400% 100%; animation: shimmer 1.4s infinite; border-radius: 6px; }
 @keyframes shimmer { 0% { background-position: 100% 0; } 100% { background-position: 0 0; } }
 .hide { display: none !important; }
+.sr-only { position: absolute; width: 1px; height: 1px; padding: 0; margin: -1px; overflow: hidden; clip: rect(0,0,0,0); white-space: nowrap; border: 0; }
 
 /* score color helper */
 .score-strong { color: var(--green); } .score-mid { color: var(--amber); } .score-weak { color: var(--red); }
@@ -424,3 +467,27 @@ h1,h2,h3,h4 { margin: 0; font-weight: 650; letter-spacing: -0.01em; }
 .callout--privacy svg { color: var(--text-tertiary); }
 .callout__title { font-weight: 600; margin-bottom: 2px; }
 .callout__body { color: var(--text-secondary); font-size: 13px; }
+
+/* ----------------------------------------------------------------- phone layout */
+/* Placed last so these win over the base widths (media queries add no specificity). */
+@media (max-width: 640px){
+  .topbar{ padding: 0 12px; gap: 8px; }
+  /* title takes the room between hamburger and actions and truncates instead of
+     collapsing to vertical text; the flex spacer isn't needed at this width */
+  .topbar__title{ flex: 1; min-width: 0; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
+  .topbar__spacer{ display: none; }
+  .input--inline{ width: 110px; max-width: 32vw; }
+  .view{ padding: 16px; }
+  /* jobs table: drop the secondary 위치·마감일 column so 회사·직무·적합도·상태 all fit */
+  .table--jobs th:nth-child(2), .table--jobs td:nth-child(2){ display: none; }
+  /* keep the 적합도 score ("88점") on one line in the narrow column */
+  .table--jobs th:nth-child(3), .table--jobs td:nth-child(3){ white-space: nowrap; }
+  .table--jobs td:nth-child(3) .tnum{ font-size: 13px; }
+  /* any remaining wide table can still scroll instead of crushing columns */
+  .table-scroll{ overflow-x: auto; -webkit-overflow-scrolling: touch; }
+  /* stack key/value so long emails·paths·URLs aren't clipped by the fixed label column */
+  .kv{ grid-template-columns: 1fr; gap: 0; }
+  .kv dt{ margin-top: 10px; }
+  .kv dd{ margin: 0 0 2px; }
+  .page-head{ flex-wrap: wrap; }
+}

package/apps/web/src/http.ts

@@ -107,8 +107,13 @@ export async function readJsonBody<T>(req: IncomingMessage, schema?: ZodType<T>)
     return schema.parse(parsed);
   } catch (e) {
     if (e instanceof ZodError) {
-      const msg = e.issues.map((i) => `${i.path.join('.')}: ${i.message}`).join(', ');
-      throw new HttpError(400, `입력값 검증 실패 — ${msg}`, 'validation');
+      // Messages already written as full Korean guidance are shown as-is (the zod
+      // path like "links.0.url" is developer jargon). Generic/English messages keep
+      // a field hint so the user knows which input to fix.
+      const msg = e.issues
+        .map((i) => (/[가-힣]/.test(i.message) ? i.message : `${i.path.join('.') || '입력값'}: ${i.message}`))
+        .join('\n');
+      throw new HttpError(400, msg, 'validation');
     }
     throw e;
   }
@@ -170,11 +175,33 @@ export function serveStatic(
   const mime = MIME[ext] ?? 'application/octet-stream';
   let payload: Buffer | string = fs.readFileSync(resolved);
   if (transform && (ext === '.html')) payload = transform(payload.toString('utf8'));
-  res.writeHead(200, {
+  const headers: Record<string, string> = {
     'Content-Type': mime,
     'X-Content-Type-Options': 'nosniff',
     'Cache-Control': ext === '.html' ? 'no-store' : 'no-cache',
-  });
+  };
+  if (ext === '.html') {
+    // Content-Security-Policy: with no inline scripts and only same-origin
+    // assets, any XSS that slips past escaping can't load external code or
+    // exfiltrate (connect-src 'self'). Dashboard pages (served with the token
+    // transform) hold the CSRF token and render user-controlled career data, so
+    // they get a strict no-inline-script policy. The install page (no transform)
+    // is static marketing with inline bootstrap scripts (theme/carousel), so it
+    // permits inline script but keeps every other hardening directive.
+    const scriptSrc = transform ? "script-src 'self'" : "script-src 'self' 'unsafe-inline'";
+    headers['Content-Security-Policy'] = [
+      "default-src 'none'",
+      scriptSrc,
+      "style-src 'self' 'unsafe-inline'", // inline style="" attrs + JS-set element styles
+      "img-src 'self' data:", // data: favicon + local screenshots/icons
+      "font-src 'self'",
+      "connect-src 'self'",
+      "base-uri 'none'",
+      "form-action 'none'",
+      "frame-ancestors 'none'", // clickjacking guard
+    ].join('; ');
+  }
+  res.writeHead(200, headers);
   res.end(payload);
   return true;
 }

package/apps/web/src/info.ts

@@ -3,21 +3,18 @@
  * endpoint. Lets non-technical users *see* where their data lives, which is a
  * core privacy promise: everything is on this machine.
  */
-import { getDataDir, getDbPath, getExportsDir, getBackupsDir } from '@careermate/db';
 import {
-  profileRepo,
-  experienceRepo,
-  projectRepo,
-  skillRepo,
-  documentRepo,
-  coverLetterRepo,
-  jobRepo,
-  applicationRepo,
-  interviewRepo,
+  getDataDir,
+  getDbPath,
+  getExportsDir,
+  getBackupsDir,
+  getEntityCounts,
 } from '@careermate/db';
+import { APP_VERSION } from '@careermate/shared';
 
 export const APP_NAME = 'CareerMate';
-export const APP_VERSION = '0.1.0';
+// 버전은 @careermate/shared 단일 출처에서. (번들에서 package.json 버전으로 치환)
+export { APP_VERSION };
 
 let _port = 0;
 export function setServerPort(port: number): void {
@@ -35,16 +32,6 @@ export function getServerInfo() {
     exports_dir: getExportsDir(),
     backups_dir: getBackupsDir(),
     node_version: process.version,
-    counts: {
-      profile: profileRepo.get() ? 1 : 0,
-      experiences: experienceRepo.list().length,
-      projects: projectRepo.list().length,
-      skills: skillRepo.list().length,
-      documents: documentRepo.list().length,
-      cover_letters: coverLetterRepo.list().length,
-      jobs: jobRepo.list().length,
-      applications: applicationRepo.list().length,
-      interview_preps: interviewRepo.list().length,
-    },
+    counts: getEntityCounts(),
   };
 }

package/apps/web/src/routes.ts

@@ -22,7 +22,9 @@ import {
   APPLICATION_STATUS_LABELS,
   DOCUMENT_KIND_LABELS,
   APPLICATION_BOARD_ORDER,
+  INTERVIEW_UNLOCK_STATUSES,
   type DocumentKind,
+  type JobInput,
 } from '@careermate/shared';
 import {
   profileRepo,
@@ -44,6 +46,9 @@ import {
   listRecentActivity,
   saveProfile,
   addResume,
+  addExperience,
+  addProject,
+  addSkill,
   saveJobPosting,
   saveFitAnalysis,
   saveCoverLetterVersion,
@@ -95,9 +100,11 @@ export function registerApiRoutes(router: Router): void {
   router.get('/api/health', () => ({ ok: true, ...getServerInfo() }));
   router.get('/api/onboarding', () => getOnboardingStatus());
   router.get('/api/summary', () => getHomeSummary());
-  router.get('/api/activity', (ctx) => ({
-    activities: listRecentActivity(Number(ctx.query.get('limit') ?? 30)),
-  }));
+  router.get('/api/activity', (ctx) => {
+    const raw = Number(ctx.query.get('limit'));
+    const limit = Number.isFinite(raw) && raw > 0 ? Math.min(raw, 100) : 30;
+    return { activities: listRecentActivity(limit) };
+  });
   router.get('/api/context', (ctx) =>
     getApplicationContext({ job_id: ctx.query.get('job_id') ?? undefined }),
   );
@@ -119,9 +126,7 @@ export function registerApiRoutes(router: Router): void {
   router.get('/api/experiences', () => ({ experiences: experienceRepo.list() }));
   router.post('/api/experiences', async (ctx) => {
     const input = await readJsonBody(ctx.req, ExperienceInputSchema);
-    const exp = experienceRepo.add(input);
-    activityRepo.log('profile_updated', `경력(${exp.company})을 추가했습니다.`, 'experience', exp.id);
-    return { experience: exp };
+    return { experience: addExperience(input) };
   });
   router.put('/api/experiences/:id', async (ctx) => {
     const input = await readJsonBody(ctx.req, ExperienceInputSchema.partial());
@@ -135,9 +140,7 @@ export function registerApiRoutes(router: Router): void {
   router.get('/api/projects', () => ({ projects: projectRepo.list() }));
   router.post('/api/projects', async (ctx) => {
     const input = await readJsonBody(ctx.req, ProjectInputSchema);
-    const prj = projectRepo.add(input);
-    activityRepo.log('profile_updated', `프로젝트(${prj.name})를 추가했습니다.`, 'project', prj.id);
-    return { project: prj };
+    return { project: addProject(input) };
   });
   router.put('/api/projects/:id', async (ctx) => {
     const input = await readJsonBody(ctx.req, ProjectInputSchema.partial());
@@ -151,7 +154,7 @@ export function registerApiRoutes(router: Router): void {
   router.get('/api/skills', () => ({ skills: skillRepo.list() }));
   router.post('/api/skills', async (ctx) => {
     const input = await readJsonBody(ctx.req, SkillInputSchema);
-    return { skill: skillRepo.add(input) };
+    return { skill: addSkill(input) };
   });
   router.put('/api/skills/:id', async (ctx) => {
     const input = await readJsonBody(ctx.req, SkillInputSchema.partial());
@@ -239,9 +242,11 @@ export function registerApiRoutes(router: Router): void {
   router.get('/api/jobs/:id', (ctx) => ({ job: jobDetail(id(ctx)) }));
   router.put('/api/jobs/:id', async (ctx) => {
     const input = await readJsonBody(ctx.req, JobInputSchema.partial());
-    const existing = jobRepo.get(id(ctx));
-    if (!existing) throw new HttpError(404, '공고를 찾을 수 없습니다.');
-    const job = jobRepo.upsert({ ...existing, ...input } as any, existing.id);
+    const jid = id(ctx);
+    if (!jobRepo.get(jid)) throw new HttpError(404, '공고를 찾을 수 없습니다.');
+    // upsert가 id로 기존 레코드와 병합하므로 누락 필드는 기존 값이 유지된다.
+    // (존재를 위에서 확인했으므로 partial을 JobInput으로 좁혀 전달.)
+    const job = jobRepo.upsert(input as JobInput, jid);
     return { job: jobWithMeta(job) };
   });
   router.delete('/api/jobs/:id', (ctx) => ({ ok: jobRepo.remove(id(ctx)) }));
@@ -259,7 +264,7 @@ export function registerApiRoutes(router: Router): void {
     const preps = interviewRepo.list().map((p) => ({ ...p, job: jobRepo.get(p.job_id) }));
     const eligible = applicationRepo
       .list()
-      .filter((a) => ['document_passed', 'interview', 'final_passed'].includes(a.status))
+      .filter((a) => INTERVIEW_UNLOCK_STATUSES.includes(a.status))
       .map((a) => ({
         job: jobRepo.get(a.job_id),
         status: a.status,

package/apps/web/src/server.ts

@@ -6,15 +6,12 @@ import http from 'node:http';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { getDb, writeRuntimeInfo, clearRuntimeInfo } from '@careermate/db';
+import { BUNDLED } from '@careermate/shared';
 import { checkRequest, injectToken } from './security.ts';
 import { Router, sendJson, sendDownload, serveStatic, HttpError } from './http.ts';
 import { registerApiRoutes, isDownload } from './routes.ts';
 import { setServerPort } from './info.ts';
 
-// 번들 빌드(esbuild)에서 true로 치환된다. tsx 개발 실행에서는 정의되지 않아 typeof로 안전 분기.
-declare const __BUNDLED__: boolean | undefined;
-const BUNDLED = typeof __BUNDLED__ !== 'undefined' && __BUNDLED__;
-
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 // dev(tsx): apps/web/src 기준 상대경로 · prod(dist/web.mjs): dist 기준.
 const WEB_ROOT = BUNDLED ? path.resolve(__dirname, 'public') : path.resolve(__dirname, '..', 'public');
@@ -77,9 +74,11 @@ export function createServer(): http.Server {
         return;
       }
       if (pathname.startsWith('/install/')) {
+        // The install page is public static guidance and uses no API/CSRF token,
+        // so do not inject the session token there (least privilege).
         const rel = pathname === '/install/' ? 'index.html' : pathname.slice('/install/'.length);
-        if (serveStatic(res, INSTALL_ROOT, rel, injectToken)) return;
-        if (serveStatic(res, INSTALL_ROOT, 'index.html', injectToken)) return;
+        if (serveStatic(res, INSTALL_ROOT, rel)) return;
+        if (serveStatic(res, INSTALL_ROOT, 'index.html')) return;
       }
 
       // Dashboard static assets, with SPA fallback to index.html.
@@ -113,29 +112,35 @@ export function startServer(preferredPort: number): Promise<StartedServer> {
 
   return new Promise((resolve, reject) => {
     let attempt = 0;
-    const tryListen = (port: number) => {
-      server.once('error', (e: NodeJS.ErrnoException) => {
-        if (e.code === 'EADDRINUSE' && attempt < 15) {
-          attempt++;
-          tryListen(port + 1);
-        } else {
-          reject(e);
-        }
-      });
-      server.listen(port, '127.0.0.1', () => {
-        setServerPort(port);
-        const url = `http://127.0.0.1:${port}`;
-        // Publish our address so the MCP server (a separate process) can find us.
-        writeRuntimeInfo({ url, port, pid: process.pid, started_at: new Date().toISOString() });
-        const cleanup = () => {
-          clearRuntimeInfo();
-          process.exit(0);
-        };
-        process.on('SIGINT', cleanup);
-        process.on('SIGTERM', cleanup);
-        resolve({ server, port, url });
-      });
+    // Persistent handlers (attached once). Re-calling server.listen() on the same
+    // server for retries must NOT pass a one-time 'listening' callback per attempt:
+    // those accumulate and all fire on the eventual bind, so the FIRST (wrong) port
+    // would win the resolve. Instead read the real bound port from server.address().
+    const onError = (e: NodeJS.ErrnoException) => {
+      if (e.code === 'EADDRINUSE' && attempt < 15) {
+        attempt++;
+        server.listen(preferredPort + attempt, '127.0.0.1');
+      } else {
+        reject(e);
+      }
     };
-    tryListen(preferredPort);
+    server.on('error', onError);
+    server.once('listening', () => {
+      server.removeListener('error', onError);
+      const addr = server.address();
+      const port = typeof addr === 'object' && addr ? addr.port : preferredPort;
+      setServerPort(port);
+      const url = `http://127.0.0.1:${port}`;
+      // Publish our address so the MCP server (a separate process) can find us.
+      writeRuntimeInfo({ url, port, pid: process.pid, started_at: new Date().toISOString() });
+      const cleanup = () => {
+        clearRuntimeInfo();
+        process.exit(0);
+      };
+      process.on('SIGINT', cleanup);
+      process.on('SIGTERM', cleanup);
+      resolve({ server, port, url });
+    });
+    server.listen(preferredPort, '127.0.0.1');
   });
 }

package/apps/web/src/settings.ts

@@ -4,28 +4,32 @@
  */
 import fs from 'node:fs';
 import path from 'node:path';
+import type { DatabaseSync } from 'node:sqlite';
 import { getDb, getDbPath, getBackupsDir, getDataDir } from '@careermate/db';
 
-const TABLES = [
-  'profile',
-  'experiences',
-  'projects',
-  'skills',
-  'documents',
-  'cover_letters',
-  'cover_letter_versions',
-  'jobs',
-  'fit_analyses',
-  'applications',
-  'interview_preps',
-  'activities',
-];
+/**
+ * Every user-data table, discovered from the live schema rather than a hand-kept
+ * list — so a table added by a future migration is automatically included in
+ * export/backup/reset (a stale list would silently skip it, e.g. dropping data
+ * on reset that was never backed up). `_meta` (schema_version) is intentionally
+ * excluded so reset keeps the migration state. Names come from sqlite_master,
+ * not user input, so interpolating them into SQL below is safe.
+ */
+function listTables(db: DatabaseSync): string[] {
+  return (
+    db
+      .prepare(
+        `SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' AND name != '_meta' ORDER BY name`,
+      )
+      .all() as { name: string }[]
+  ).map((r) => r.name);
+}
 
 /** Full machine-readable dump of every table — portable backup / GDPR-style export. */
 export function exportAll(): { exported_at: string; version: number; tables: Record<string, unknown[]> } {
   const db = getDb();
   const tables: Record<string, unknown[]> = {};
-  for (const t of TABLES) {
+  for (const t of listTables(db)) {
     tables[t] = db.prepare(`SELECT * FROM ${t}`).all();
   }
   const ver = db.prepare(`SELECT value FROM _meta WHERE key='schema_version'`).get() as
@@ -40,8 +44,22 @@ export function createBackup(): { backup_path: string; json_path: string } {
   const dir = getBackupsDir();
   const dbBackup = path.join(dir, `careermate-${stamp}.sqlite`);
   const jsonBackup = path.join(dir, `careermate-${stamp}.json`);
-  // Use SQLite's online backup via VACUUM INTO for a consistent snapshot.
+
+  // Defense in depth: the backup target must stay inside the backups directory,
+  // even though the filename is built from a controlled timestamp.
+  const resolvedDir = path.resolve(dir);
+  if (!path.resolve(dbBackup).startsWith(resolvedDir + path.sep)) {
+    throw new Error('백업 경로가 백업 폴더를 벗어났습니다.');
+  }
+
+  // Prefer SQLite's VACUUM INTO for a WAL-consistent snapshot. node:sqlite's
+  // exec() can't bind parameters, so the path is embedded as a quoted string
+  // literal (single quotes doubled). If the path can't be embedded safely
+  // (NUL / newline), fall back to a plain file copy instead of risking a
+  // malformed statement.
+  const safeForLiteral = !/[\0\n\r]/.test(dbBackup);
   try {
+    if (!safeForLiteral) throw new Error('backup path not safe for SQL literal');
     getDb().exec(`VACUUM INTO '${dbBackup.replace(/'/g, "''")}'`);
   } catch {
     fs.copyFileSync(getDbPath(), dbBackup);
@@ -60,7 +78,7 @@ export function resetAll(confirm: string): { ok: boolean; backup_path?: string }
   const db = getDb();
   db.exec('BEGIN');
   try {
-    for (const t of TABLES) db.exec(`DELETE FROM ${t}`);
+    for (const t of listTables(db)) db.exec(`DELETE FROM ${t}`);
     db.exec('COMMIT');
   } catch (e) {
     db.exec('ROLLBACK');

package/bin/careermate.mjs

@@ -33,11 +33,14 @@ const BUNDLES = {
   mcp: 'dist/mcp.mjs',
   start: 'dist/web.mjs',
   dashboard: 'dist/web.mjs',
+  doctor: 'dist/doctor.mjs',
+  migrate: 'dist/migrate.mjs',
 };
 
 const [cmd = 'help', ...rest] = process.argv.slice(2);
 
-if (cmd === 'help' || cmd === '--help' || cmd === '-h' || !ENTRIES[cmd]) {
+const isHelp = cmd === 'help' || cmd === '--help' || cmd === '-h';
+if (isHelp || !ENTRIES[cmd]) {
   const lines = [
     'CareerMate — 내 AI를 커리어 비서로 (로컬 MCP 도구)',
     '',
@@ -50,10 +53,10 @@ if (cmd === 'help' || cmd === '--help' || cmd === '-h' || !ENTRIES[cmd]) {
     '',
     '처음이라면:  careermate init  → AI 클라이언트 재시작',
   ];
-  // 알 수 없는 명령이면 안내를 stderr로 보내 stdout(MCP 전송 채널)을 오염시키지 않는다.
-  const out = ENTRIES[cmd] ? console.log : console.error;
-  out(lines.join('\n'));
-  process.exit(cmd === 'help' || cmd === '--help' || cmd === '-h' ? 0 : 1);
+  // 명시적 도움말은 stdout+exit0, 알 수 없는 명령은 stderr+exit1
+  // (stdout은 MCP 전송 채널이므로 오류 안내로 오염시키지 않는다).
+  (isHelp ? console.log : console.error)(lines.join('\n'));
+  process.exit(isHelp ? 0 : 1);
 }
 
 const bundle = BUNDLES[cmd] ? path.join(ROOT, BUNDLES[cmd]) : null;