careervivid 1.12.31 → 1.12.36

package/dist/agent/agentAuditLog.d.ts

@@ -0,0 +1,43 @@
+/**
+ * agentAuditLog.ts — Forensic audit trail for every agent tool call.
+ *
+ * Architecture:
+ *   PRIMARY:   Local JSONL append at ~/.careervivid/agent-audit.log
+ *              Fast, offline, zero network dependency.
+ *              Each line is a self-contained JSON record.
+ *
+ *   SECONDARY: Firebase Firestore (jastalk-firebase / agent_audit_logs)
+ *              Written fire-and-forget (non-blocking). Fails silently.
+ *              Gives cloud visibility and cross-device forensics via the web dashboard.
+ *
+ * Usage (in repl.ts):
+ *   import { auditLog, flushAuditLog } from "./agentAuditLog.js";
+ *   auditLog({ sessionId, tool: name, args, result, durationMs });
+ *   // On session end:
+ *   await flushAuditLog();
+ */
+export interface AuditEntry {
+    ts: string;
+    sessionId: string;
+    tool: string;
+    args: Record<string, unknown>;
+    resultSummary: string;
+    durationMs: number;
+    ok: boolean;
+}
+export declare let SESSION_ID: string;
+export declare function auditLog(entry: {
+    sessionId?: string;
+    tool: string;
+    args: Record<string, unknown>;
+    result: string;
+    durationMs: number;
+}): void;
+export declare function flushAuditLog(): Promise<void>;
+export declare function writeSessionSummary(stats: {
+    turns: number;
+    mutations: number;
+    toolCalls: number;
+    creditsUsed?: number;
+}): Promise<void>;
+//# sourceMappingURL=agentAuditLog.d.ts.map

package/dist/agent/agentAuditLog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentAuditLog.d.ts","sourceRoot":"","sources":["../../src/agent/agentAuditLog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AASH,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,OAAO,CAAC;CACb;AAID,eAAO,IAAI,UAAU,QAA2B,CAAC;AA8BjD,wBAAgB,QAAQ,CAAC,KAAK,EAAE;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,IAAI,CAuBP;AAwCD,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAMnD;AAID,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBhB"}

package/dist/agent/agentAuditLog.js

@@ -0,0 +1,145 @@
+/**
+ * agentAuditLog.ts — Forensic audit trail for every agent tool call.
+ *
+ * Architecture:
+ *   PRIMARY:   Local JSONL append at ~/.careervivid/agent-audit.log
+ *              Fast, offline, zero network dependency.
+ *              Each line is a self-contained JSON record.
+ *
+ *   SECONDARY: Firebase Firestore (jastalk-firebase / agent_audit_logs)
+ *              Written fire-and-forget (non-blocking). Fails silently.
+ *              Gives cloud visibility and cross-device forensics via the web dashboard.
+ *
+ * Usage (in repl.ts):
+ *   import { auditLog, flushAuditLog } from "./agentAuditLog.js";
+ *   auditLog({ sessionId, tool: name, args, result, durationMs });
+ *   // On session end:
+ *   await flushAuditLog();
+ */
+import { appendFileSync, existsSync, mkdirSync } from "fs";
+import { resolve } from "path";
+import { homedir } from "os";
+import { randomUUID } from "crypto";
+// ── Session-level state ───────────────────────────────────────────────────────
+export let SESSION_ID = randomUUID().slice(0, 8);
+const pendingFirestore = [];
+// ── Local JSONL path ──────────────────────────────────────────────────────────
+function getAuditLogPath() {
+    const dir = resolve(homedir(), ".careervivid");
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true });
+    return resolve(dir, "agent-audit.log");
+}
+// ── Sanitize args (remove any key that looks like a secret) ─────────────────
+function sanitizeArgs(args) {
+    const REDACT_KEYS = /key|secret|password|token|auth|credential/i;
+    const out = {};
+    for (const [k, v] of Object.entries(args)) {
+        if (REDACT_KEYS.test(k)) {
+            out[k] = "***REDACTED***";
+        }
+        else if (typeof v === "string" && v.length > 300) {
+            out[k] = v.slice(0, 300) + "…";
+        }
+        else {
+            out[k] = v;
+        }
+    }
+    return out;
+}
+// ── Core log function (sync local + async Firestore) ─────────────────────────
+export function auditLog(entry) {
+    const record = {
+        ts: new Date().toISOString(),
+        sessionId: entry.sessionId ?? SESSION_ID,
+        tool: entry.tool,
+        args: sanitizeArgs(entry.args),
+        resultSummary: entry.result.slice(0, 200).replace(/\n/g, " "),
+        durationMs: Math.round(entry.durationMs),
+        ok: !entry.result.startsWith("❌"),
+    };
+    // ── 1. Local JSONL (synchronous, never fails) ─────────────────────────────
+    try {
+        appendFileSync(getAuditLogPath(), JSON.stringify(record) + "\n", "utf-8");
+    }
+    catch {
+        // Silently swallow — never break the agent because of logging
+    }
+    // ── 2. Firebase Firestore (fire-and-forget — non-blocking) ───────────────
+    pendingFirestore.push(record);
+    void writeToFirestore(record).catch(() => {
+        // Silently swallow — Firebase being unavailable must not affect the agent
+    });
+}
+// ── Firebase write (dynamic import to avoid hard dependency) ─────────────────
+async function writeToFirestore(record) {
+    // Only attempt if firebase-admin is installed (it's optional)
+    let admin;
+    try {
+        admin = await import("firebase-admin");
+    }
+    catch {
+        return; // firebase-admin not installed — skip silently
+    }
+    try {
+        if (!admin.apps?.length) {
+            // Use Application Default Credentials (works in GCP/Cloud Shell)
+            // or the service account key if present
+            const keyPath = resolve(homedir(), ".careervivid", "firebase-service-account.json");
+            const credential = existsSync(keyPath)
+                ? admin.credential.cert(keyPath)
+                : admin.credential.applicationDefault();
+            admin.initializeApp({
+                credential,
+                projectId: "jastalk-firebase",
+            });
+        }
+        const db = admin.firestore();
+        await db.collection("agent_audit_logs").add({
+            ...record,
+            createdAt: admin.firestore.FieldValue.serverTimestamp(),
+        });
+    }
+    catch {
+        // Any Firebase error is silently swallowed
+    }
+}
+// ── Flush pending entries (call on session end) ───────────────────────────────
+export async function flushAuditLog() {
+    // Pending Firestore writes are already in-flight via fire-and-forget.
+    // Give them 2 seconds to complete before exit.
+    if (pendingFirestore.length > 0) {
+        await new Promise(r => setTimeout(r, 2000));
+    }
+}
+// ── Session summary (call on exit) ─────────────────────────────────────────
+export async function writeSessionSummary(stats) {
+    const record = {
+        type: "session_summary",
+        sessionId: SESSION_ID,
+        ts: new Date().toISOString(),
+        ...stats,
+    };
+    try {
+        appendFileSync(getAuditLogPath(), JSON.stringify(record) + "\n", "utf-8");
+    }
+    catch { /* silent */ }
+    // Firestore session summary
+    let admin;
+    try {
+        admin = await import("firebase-admin");
+    }
+    catch {
+        return;
+    }
+    try {
+        if (admin.apps?.length) {
+            const db = admin.firestore();
+            await db.collection("agent_session_summaries").add({
+                ...record,
+                createdAt: admin.firestore.FieldValue.serverTimestamp(),
+            });
+        }
+    }
+    catch { /* silent */ }
+}

package/dist/agent/instructions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"instructions.d.ts","sourceRoot":"","sources":["../../src/agent/instructions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,eAAO,MAAM,aAAa,QAalB,CAAC;AAMT,eAAO,MAAM,cAAc,QAcnB,CAAC;AAMT,eAAO,MAAM,cAAc,QAgBnB,CAAC;AAMT,eAAO,MAAM,kBAAkB,QAoCvB,CAAC;AAMT,eAAO,MAAM,YAAY,QAsCjB,CAAC;AAMT,eAAO,MAAM,iBAAiB,QActB,CAAC;AAMT;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE;IACzC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,GAAG,MAAM,CAyBT"}
+{"version":3,"file":"instructions.d.ts","sourceRoot":"","sources":["../../src/agent/instructions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,eAAO,MAAM,aAAa,QAalB,CAAC;AAMT,eAAO,MAAM,cAAc,QAcnB,CAAC;AAMT,eAAO,MAAM,cAAc,QAgBnB,CAAC;AAMT,eAAO,MAAM,kBAAkB,QAqCvB,CAAC;AAMT,eAAO,MAAM,YAAY,QAuCjB,CAAC;AAMT,eAAO,MAAM,iBAAiB,QActB,CAAC;AAMT;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE;IACzC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,GAAG,MAAM,CAyBT"}

package/dist/agent/instructions.js

@@ -86,6 +86,7 @@ These tools read/write jobs.csv — the local career-ops pipeline spreadsheet.
 - **tracker_dashboard**      — Full analytics: apply rate, avg scores, salary data, stale count.
 - **tracker_find_stale**     — Surface cold companies with next-action recommendations.
 - **tracker_inspect_quality**— Scan for duplicates, missing URLs, and corrupted data (read-only).
+- **tracker_recheck_urls**   — Re-verify all careers URLs in the tracker; annotates dead links in notes.
 
 ### Web Kanban Board (kanban_*)
 These tools read/write the Firebase Kanban board at careervivid.app/job-tracker.
@@ -109,7 +110,7 @@ export const JOBS_HARNESS = `
 ## Autonomy Rules (Non-Negotiable)
 
 ### What you may do freely (no confirmation needed)
-- Call any read-only tool (tracker_list_jobs, tracker_dashboard, tracker_rank_priority, tracker_find_stale, tracker_inspect_quality, search_jobs, get_resume, etc.)
+- Call any read-only tool (tracker_list_jobs, tracker_dashboard, tracker_rank_priority, tracker_find_stale, tracker_inspect_quality, tracker_recheck_urls, search_jobs, get_resume, etc.)
 - Add a new company/job entry via tracker_add_job (when the user explicitly names a company or approves a search result)
 - Update non-status fields (attention_score, excitement, notes, follow_up_date, etc.) via tracker_update_job
 
@@ -138,6 +139,7 @@ If it does, call tracker_update_job instead — never create a duplicate row.
 | stats, dashboard, apply rate, search health   | tracker_dashboard              |
 | stale, cold, neglecting, need attention       | tracker_find_stale             |
 | duplicates, data quality, audit               | tracker_inspect_quality        |
+| stale/dead job URLs, link check               | tracker_recheck_urls           |
 | adding a company, new job                     | tracker_add_job                |
 | updating status, marking applied, follow-up   | tracker_update_job             |
 | Kanban board, web tracker                     | kanban_list_jobs               |

package/dist/agent/tools/local-tracker.d.ts

@@ -31,5 +31,6 @@ export declare const ScorePipelineTool: Tool;
 export declare const GetPipelineMetricsTool: Tool;
 export declare const FlagStaleJobsTool: Tool;
 export declare const InspectQualityTool: Tool;
+export declare const RecheckUrlsTool: Tool;
 export declare const ALL_LOCAL_TRACKER_TOOLS: Tool[];
 //# sourceMappingURL=local-tracker.d.ts.map

package/dist/agent/tools/local-tracker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-tracker.d.ts","sourceRoot":"","sources":["../../../src/agent/tools/local-tracker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAkClC,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAoOD,eAAO,MAAM,iBAAiB,EAAE,IA8H/B,CAAC;AAMF,eAAO,MAAM,kBAAkB,EAAE,IAqIhC,CAAC;AAMF,eAAO,MAAM,eAAe,EAAE,IAkJ7B,CAAC;AAMF,eAAO,MAAM,iBAAiB,EAAE,IA2F/B,CAAC;AAMF,eAAO,MAAM,sBAAsB,EAAE,IA+GpC,CAAC;AAMF,eAAO,MAAM,iBAAiB,EAAE,IAoE/B,CAAC;AAMF,eAAO,MAAM,kBAAkB,EAAE,IAsEhC,CAAC;AAMF,eAAO,MAAM,uBAAuB,EAAE,IAAI,EAQzC,CAAC"}
+{"version":3,"file":"local-tracker.d.ts","sourceRoot":"","sources":["../../../src/agent/tools/local-tracker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAkClC,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAuRD,eAAO,MAAM,iBAAiB,EAAE,IA8H/B,CAAC;AAMF,eAAO,MAAM,kBAAkB,EAAE,IAgJhC,CAAC;AAMF,eAAO,MAAM,eAAe,EAAE,IAkJ7B,CAAC;AAMF,eAAO,MAAM,iBAAiB,EAAE,IA2F/B,CAAC;AAMF,eAAO,MAAM,sBAAsB,EAAE,IA+GpC,CAAC;AAMF,eAAO,MAAM,iBAAiB,EAAE,IAoE/B,CAAC;AAMF,eAAO,MAAM,kBAAkB,EAAE,IAsEhC,CAAC;AAMF,eAAO,MAAM,eAAe,EAAE,IAoG7B,CAAC;AAMF,eAAO,MAAM,uBAAuB,EAAE,IAAI,EASzC,CAAC"}

package/dist/agent/tools/local-tracker.js

@@ -19,7 +19,7 @@
  *   flag_stale_jobs       → surface companies with no recent activity
  */
 import { Type } from "@google/genai";
-import { readFileSync, writeFileSync, existsSync, mkdirSync, copyFileSync } from "fs";
+import { readFileSync, writeFileSync, existsSync, mkdirSync, copyFileSync, unlinkSync, renameSync, statSync } from "fs";
 import { resolve, dirname } from "path";
 import { fileURLToPath } from "url";
 import { homedir } from "os";
@@ -175,6 +175,26 @@ function parseCsv(raw) {
         return row;
     });
 }
+/** Validate a parsed row has the minimum viable fields. Returns true if usable. */
+function isValidRow(row, lineNum) {
+    if (!row.id || !/^[A-Z]{1,5}-\d{3,}$/.test(row.id)) {
+        process.stderr.write(`[tracker] Skipping corrupt row ${lineNum}: id="${row.id}" is malformed\n`);
+        return false;
+    }
+    if (!row.company) {
+        process.stderr.write(`[tracker] Skipping row ${lineNum} (id=${row.id}): missing company\n`);
+        return false;
+    }
+    // Numeric fields must parse or be empty
+    for (const field of ["attention_score", "excitement", "fit_score"]) {
+        const v = row[field];
+        if (v !== "" && isNaN(Number(v))) {
+            process.stderr.write(`[tracker] Row ${row.id}: field ${field}="${v}" is not numeric — resetting to 7\n`);
+            row[field] = "7";
+        }
+    }
+    return true;
+}
 function serializeCsv(rows) {
     const header = HEADERS.join(",");
     const data = rows.map((row) => HEADERS.map((h) => {
@@ -194,14 +214,48 @@ function loadCsv() {
         console.log(`   Add jobs with cv agent, or edit the CSV directly.\n`);
     }
     const raw = readFileSync(path, "utf-8");
-    return { rows: parseCsv(raw), path };
+    const allRows = parseCsv(raw);
+    // #2 Schema validation — filter out rows that would cause runtime crashes
+    const rows = allRows.filter((r, i) => isValidRow(r, i + 2)); // +2: 1-indexed + header line
+    return { rows, path };
 }
 function saveCsv(rows, csvPath) {
-    // Auto-backup before every write — recoverable with jobs.csv.bak
-    if (existsSync(csvPath)) {
-        copyFileSync(csvPath, csvPath + ".bak");
+    const lockPath = csvPath + ".lock";
+    // #8 Lock file — prevent concurrent session writes
+    if (existsSync(lockPath)) {
+        let staleMs = 30_000; // if lock is >30s old, assume stale and proceed
+        try {
+            staleMs = Date.now() - statSync(lockPath).mtimeMs;
+        }
+        catch { /* */ }
+        if (staleMs < 10_000) {
+            throw new Error("⛔ Another agent session is writing to jobs.csv. Wait a moment and try again.");
+        }
+        // Stale lock — remove it
+        try {
+            unlinkSync(lockPath);
+        }
+        catch { /* */ }
+    }
+    // Acquire lock
+    writeFileSync(lockPath, String(Date.now()), "utf-8");
+    try {
+        // #1 Backup
+        if (existsSync(csvPath)) {
+            copyFileSync(csvPath, csvPath + ".bak");
+        }
+        // #1 Atomic write — write to .tmp then rename (crash-safe)
+        const tmpPath = csvPath + ".tmp";
+        writeFileSync(tmpPath, serializeCsv(rows), "utf-8");
+        renameSync(tmpPath, csvPath);
+    }
+    finally {
+        // Always release the lock
+        try {
+            unlinkSync(lockPath);
+        }
+        catch { /* */ }
     }
-    writeFileSync(csvPath, serializeCsv(rows), "utf-8");
 }
 function today() {
     return new Date().toISOString().slice(0, 10);
@@ -440,8 +494,15 @@ IMPORTANT: To change status to 'Applied', you MUST also provide date_applied (YY
                 row.contact = args.contact;
             }
             if (args.contact_email) {
-                changes.push(`contact_email: ${args.contact_email}`);
-                row.contact_email = args.contact_email;
+                // #10 Email sanitization — allow only valid email characters
+                const sanitized = args.contact_email.replace(/[^a-zA-Z0-9@._+\-]/g, "").slice(0, 254);
+                if (sanitized !== args.contact_email) {
+                    changes.push(`contact_email (sanitized): ${sanitized}`);
+                }
+                else {
+                    changes.push(`contact_email: ${sanitized}`);
+                }
+                row.contact_email = sanitized;
             }
             if (args.attention_score !== undefined) {
                 const v = Math.min(10, Math.max(1, Math.round(args.attention_score)));
@@ -453,8 +514,10 @@ IMPORTANT: To change status to 'Applied', you MUST also provide date_applied (YY
                 row.apply_effort = args.apply_effort;
             }
             if (args.prep_time_hours !== undefined) {
-                changes.push(`prep_time_hours: ${args.prep_time_hours}`);
-                row.prep_time_hours = String(args.prep_time_hours);
+                // #5 Clamp 0-200 hours (reasonable upper bound)
+                const v = Math.max(0, Math.min(200, Math.round(Number(args.prep_time_hours) || 0)));
+                changes.push(`prep_time_hours: ${v}`);
+                row.prep_time_hours = String(v);
             }
             if (args.excitement !== undefined) {
                 const v = Math.min(10, Math.max(1, Math.round(args.excitement)));
@@ -959,6 +1022,104 @@ Use this when the user asks: "clean up my tracker", "find duplicates", "audit my
     },
 };
 // ---------------------------------------------------------------------------
+// Tool: tracker_recheck_urls (#7 — Stale URL recheck)
+// ---------------------------------------------------------------------------
+export const RecheckUrlsTool = {
+    name: "tracker_recheck_urls",
+    description: `Re-verify all careers_url fields in jobs.csv to find dead job postings.
+Only checks entries that have a URL and haven't been re-verified in the last 7 days.
+Updates the notes field with a ⚠️ DEAD LINK tag for any URL that fails verification.
+Returns a full report of live vs dead URLs.
+Use when the user asks: "are my job links still active?", "check stale URLs", "audit my links".`,
+    parameters: {
+        type: Type.OBJECT,
+        properties: {
+            force: {
+                type: Type.BOOLEAN,
+                description: "Optional. If true, re-checks ALL URLs regardless of when they were last checked. Default false.",
+            },
+            status_filter: {
+                type: Type.STRING,
+                description: "Optional. Only check entries with this status (e.g. 'To Apply'). Default: all statuses.",
+            },
+        },
+        required: [],
+    },
+    execute: async (args) => {
+        try {
+            const { rows, path } = loadCsv();
+            const { verifyUrlBatch } = await import("./urlVerifier.js");
+            // Filter rows that have a URL and are candidates for recheck
+            let candidates = rows.filter(r => r.careers_url && r.careers_url.startsWith("http"));
+            if (args.status_filter) {
+                candidates = candidates.filter(r => r.status.toLowerCase() === args.status_filter.toLowerCase());
+            }
+            if (candidates.length === 0) {
+                return "ℹ️ No entries with verified URLs to check.";
+            }
+            process.stderr.write(`[tracker_recheck_urls] Checking ${candidates.length} URLs in batches...\n`);
+            const urls = candidates.map(r => r.careers_url);
+            const results = await verifyUrlBatch(urls);
+            const dead = [];
+            const alive = [];
+            const warnings = [];
+            for (let i = 0; i < candidates.length; i++) {
+                const row = candidates[i];
+                const result = results[i];
+                if (!result)
+                    continue;
+                if (!result.ok) {
+                    dead.push(`  ❌ [${row.id}] ${row.company} — ${row.role} (${row.status})\n     ${result.reason}`);
+                    // Mark the row with a dead link note
+                    const deadNote = "⚠️ DEAD LINK — URL failed recheck on " + today();
+                    const existingNotes = row.notes || "";
+                    const hasDeadNote = existingNotes.includes("⚠️ DEAD LINK");
+                    if (!hasDeadNote) {
+                        const rowIdx = rows.findIndex(r => r.id === row.id);
+                        if (rowIdx >= 0) {
+                            rows[rowIdx].notes = [deadNote, existingNotes].filter(Boolean).join("; ").slice(0, 500);
+                        }
+                    }
+                }
+                else {
+                    alive.push(`  ✅ [${row.id}] ${row.company} — ${row.status}`);
+                    if (result.warning) {
+                        warnings.push(`  ⚠️  [${row.id}] ${result.warning}`);
+                    }
+                    // Clear stale dead link note if now alive
+                    const rowIdx = rows.findIndex(r => r.id === row.id);
+                    if (rowIdx >= 0 && rows[rowIdx].notes?.includes("⚠️ DEAD LINK")) {
+                        rows[rowIdx].notes = rows[rowIdx].notes.replace(/⚠️ DEAD LINK[^;]*(;?\s*)?/g, "").trim();
+                    }
+                }
+            }
+            // Write back any dead link annotations
+            if (dead.length > 0) {
+                saveCsv(rows, path);
+            }
+            const sections = [
+                `🔗 URL Recheck Report — ${candidates.length} URLs checked`,
+                "─".repeat(60),
+            ];
+            if (alive.length > 0)
+                sections.push(`\n✅ Live (${alive.length}):\n${alive.join("\n")}`);
+            if (warnings.length > 0)
+                sections.push(`\n⚠️  Warnings (${warnings.length}):\n${warnings.join("\n")}`);
+            if (dead.length > 0) {
+                sections.push(`\n❌ Dead links (${dead.length}) — annotated in notes:\n${dead.join("\n")}`);
+                sections.push(`\nRecommendation: For dead links in "To Apply" status, search for the current posting or remove from tracker.`);
+            }
+            else {
+                sections.push(`\n🟢 All URLs are reachable!`);
+            }
+            return sections.join("\n");
+        }
+        catch (err) {
+            return `❌ Error rechecking URLs: ${err.message}`;
+        }
+    },
+};
+// ---------------------------------------------------------------------------
 // Export
 // ---------------------------------------------------------------------------
 export const ALL_LOCAL_TRACKER_TOOLS = [
@@ -969,4 +1130,5 @@ export const ALL_LOCAL_TRACKER_TOOLS = [
     GetPipelineMetricsTool,
     FlagStaleJobsTool,
     InspectQualityTool,
+    RecheckUrlsTool,
 ];

package/dist/agent/tools/urlVerifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"urlVerifier.d.ts","sourceRoot":"","sources":["../../../src/agent/tools/urlVerifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AA8ClC,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA4I3E;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,EAAE,GACb,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAalC;AAID,eAAO,MAAM,aAAa,EAAE,IAkD3B,CAAC;AAIF,eAAO,MAAM,uBAAuB,EAAE,IAiDrC,CAAC;AAEF,eAAO,MAAM,sBAAsB,EAAE,IAAI,EAGxC,CAAC"}
+{"version":3,"file":"urlVerifier.d.ts","sourceRoot":"","sources":["../../../src/agent/tools/urlVerifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AA8ClC,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA6K3E;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,EAAE,GACb,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAalC;AAID,eAAO,MAAM,aAAa,EAAE,IAkD3B,CAAC;AAIF,eAAO,MAAM,uBAAuB,EAAE,IAiDrC,CAAC;AAEF,eAAO,MAAM,sBAAsB,EAAE,IAAI,EAGxC,CAAC"}

package/dist/agent/tools/urlVerifier.js

@@ -158,12 +158,43 @@ export async function verifyUrl(url) {
             }
         }
         if (status >= 200 && status < 400) {
+            let contentWarning;
+            // ── 5. Content sanity — does the page look like a job posting? ────────
+            // Only run for non-ATS URLs (ATS pages are always jobs, GET-ing them is slow)
+            if (!isTrustedAts && res.bodyUsed === false) {
+                try {
+                    // Re-fetch with GET to get body (HEAD gives no body)
+                    const bodyRes = await fetch(url, {
+                        method: "GET",
+                        redirect: "follow",
+                        signal: controller.signal,
+                        headers: {
+                            "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36",
+                        },
+                    });
+                    const body = (await bodyRes.text()).toLowerCase();
+                    const JOB_SIGNALS = [
+                        "apply", "job description", "responsibilities", "requirements",
+                        "qualifications", "salary", "full-time", "part-time", "remote",
+                        "position", "role", "candidate", "experience", "interview",
+                        "benefits", "compensation",
+                    ];
+                    const signalCount = JOB_SIGNALS.filter(s => body.includes(s)).length;
+                    if (signalCount < 2) {
+                        contentWarning = `Page at ${finalUrl || url} lacks typical job-posting keywords — may redirect to homepage or be an error page.`;
+                    }
+                }
+                catch {
+                    // Content check failed (timeout, etc.) — don't block on this
+                }
+            }
             const verdict = isTrustedAts
                 ? `✅ Verified — reachable on trusted ATS (${parsed.hostname})`
                 : `✅ Reachable (status ${status})${redirected ? ` → redirected to ${finalUrl}` : ""}`;
             return {
                 url, ok: true, status, finalUrl, isTrustedAts, redirected,
                 reason: verdict,
+                warning: contentWarning,
             };
         }
         return {

package/dist/commands/agent/repl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repl.d.ts","sourceRoot":"","sources":["../../../src/commands/agent/repl.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EAA4D,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAI7G,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,GAAE,MAAM,GAAG,IAAW,QAwBtF;AAED,wBAAsB,OAAO,CAC3B,MAAM,EAAE,WAAW,GAAG,sBAAsB,GAAG,IAAI,EACnD,OAAO,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,EAC9K,gBAAgB,EAAE,WAAW,EAC7B,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,iBAAiB,EAAE,MAAM,EACzB,KAAK,EAAE,GAAG,EAAE,GACX,OAAO,CAAC,IAAI,CAAC,CAggBf"}
+{"version":3,"file":"repl.d.ts","sourceRoot":"","sources":["../../../src/commands/agent/repl.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EAA4D,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAK7G,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,GAAE,MAAM,GAAG,IAAW,QAwBtF;AAED,wBAAsB,OAAO,CAC3B,MAAM,EAAE,WAAW,GAAG,sBAAsB,GAAG,IAAI,EACnD,OAAO,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,EAC9K,gBAAgB,EAAE,WAAW,EAC7B,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,iBAAiB,EAAE,MAAM,EACzB,KAAK,EAAE,GAAG,EAAE,GACX,OAAO,CAAC,IAAI,CAAC,CAmkBf"}

package/dist/commands/agent/repl.js

@@ -5,6 +5,7 @@ import { isSafeCommand } from "../../agent/tools/coding.js";
 import { CareerVividProxyEngine } from "../../agent/CareerVividProxyEngine.js";
 import { CV_MODELS } from "./configurator.js";
 import { loadConfig, getProviderKey, setProviderKey } from "../../config.js";
+import { auditLog, writeSessionSummary, SESSION_ID } from "../../agent/agentAuditLog.js";
 const { prompt } = pkg;
 export function printCreditStatus(remaining, limit = null) {
     if (remaining === null)
@@ -29,6 +30,18 @@ export async function askLoop(engine, options, selectedProvider, selectedModel,
     let sessionTurns = 0;
     let sessionLimit = null;
     let currentModel = selectedModel;
+    // #3 Session mutation budget
+    const WRITE_TOOLS = new Set([
+        "tracker_add_job", "tracker_update_job", "kanban_add_job", "kanban_update_status",
+        "save_cover_letter", "delete_cover_letter", "write_file", "patch_file",
+        "tracker_recheck_urls",
+    ]);
+    const SESSION_MAX_MUTATIONS = 25;
+    const TURN_MAX_MUTATIONS = 10;
+    let sessionMutations = 0;
+    let turnMutations = 0;
+    // #9 Circuit breaker — detect tool call loops
+    let lastToolCall = { name: "", argsHash: "", count: 0 };
     let pasteBuffer = [];
     let byoHistory = []; // Track history for BYO providers
     // ── SIGINT handler: Ctrl+C cancels current operation and returns to prompt ──
@@ -188,9 +201,12 @@ export async function askLoop(engine, options, selectedProvider, selectedModel,
                     }
                     console.log(chalk.dim("─────────────────────────────────────────"));
                 }
+                await writeSessionSummary({ turns: sessionTurns, mutations: sessionMutations, toolCalls: 0 });
                 console.log(chalk.gray("\nGoodbye! 👋\n"));
                 process.exit(0);
             }
+            // Reset per-turn mutation counter at the start of each user message
+            turnMutations = 0;
             process.stdout.write(chalk.dim("\n⏳ Thinking...\n\n"));
             let firstChunk = true;
             let currentSpinner = null;
@@ -226,12 +242,44 @@ export async function askLoop(engine, options, selectedProvider, selectedModel,
                 browser_wait: "⏳ Waiting...",
                 browser_close: "🔒 Closing browser...",
                 browser_select: "🖱️  Selecting option...",
+                tracker_recheck_urls: "🔗 Re-checking job URLs...",
+                browser_autofill_application: "📝 Auto-filling application...",
+                verify_url: "🔍 Verifying URL...",
+                verify_job_urls: "🔍 Verifying job URLs...",
                 search_jobs: "🔍 Searching jobs...",
                 get_resume: "📄 Loading resume...",
                 list_resumes: "📄 Loading resumes...",
                 get_profile: "👤 Loading profile...",
             };
             const handleToolCall = async (name, args) => {
+                // #9 Circuit breaker: abort if same tool called 5+ times consecutively with same args
+                const argsHash = JSON.stringify(args).slice(0, 100);
+                if (lastToolCall.name === name && lastToolCall.argsHash === argsHash) {
+                    lastToolCall.count++;
+                    if (lastToolCall.count >= 5) {
+                        console.log(chalk.red(`\n⛔ Loop detected: "${name}" called ${lastToolCall.count} times with identical args. Aborting turn.`));
+                        return false;
+                    }
+                }
+                else {
+                    lastToolCall = { name, argsHash, count: 1 };
+                }
+                // #3 Per-turn mutation budget
+                if (WRITE_TOOLS.has(name)) {
+                    turnMutations++;
+                    if (turnMutations > TURN_MAX_MUTATIONS) {
+                        console.log(chalk.red(`\n⛔ Turn mutation limit (${TURN_MAX_MUTATIONS}) reached. The agent has made ${turnMutations} writes this turn.`));
+                        return false;
+                    }
+                    sessionMutations++;
+                    if (sessionMutations >= SESSION_MAX_MUTATIONS) {
+                        console.log(chalk.yellow(`\n⚠️  Session mutation budget exhausted (${SESSION_MAX_MUTATIONS} writes). Restart the agent to continue writing.`));
+                        return false;
+                    }
+                    else if (sessionMutations === SESSION_MAX_MUTATIONS - 5) {
+                        console.log(chalk.yellow(`\n💡 Heads up: ${SESSION_MAX_MUTATIONS - sessionMutations} writes remaining this session.`));
+                    }
+                }
                 // Show a clean, user-friendly label — never show raw args
                 const label = TOOL_LABELS[name] ?? `⚙️  Working...`;
                 process.stdout.write(chalk.dim(`
@@ -306,6 +354,15 @@ ${label}
                     currentSpinner.succeed(chalk.dim(`Done`));
                     currentSpinner = null;
                 }
+                // #4 Audit log — record every completed tool call
+                // durationMs is approximate since we don't have exact start time here
+                auditLog({
+                    sessionId: SESSION_ID,
+                    tool: name,
+                    args: typeof result?._args === "object" ? result._args : {},
+                    result: typeof result === "string" ? result : JSON.stringify(result ?? ""),
+                    durationMs: 0, // QueryEngine doesn't expose timing; repl.ts timing TBD
+                });
                 // Suppress raw output — the agent will summarize it in natural language
             };
             if (engine) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "careervivid",
-  "version": "1.12.31",
+  "version": "1.12.36",
   "description": "Official CLI for CareerVivid — publish articles, diagrams, and portfolio updates from your terminal or AI agent",
   "type": "module",
   "bin": {