hirify-cli 0.5.0 → 0.5.2

package/README.md

@@ -68,6 +68,8 @@ hirify filter guide
 hirify vacancy search "senior go"
 hirify vacancy read <slug>
 hirify vacancy reveal <slug>
+hirify vacancy hide <slug>...
+hirify company hide "<name>"
 hirify profile list
 hirify vacancy apply <slug> --profile <id> --cover-file cover.txt
 ```
@@ -76,6 +78,8 @@ Lists and searches are free. Reading a vacancy in full, revealing its contact, a
 have a separate allowance. `hirify account show` supplies the current values. Shortlist from cards,
 read to assess fit, then reveal what fits. Applying sends a real application and cannot be recalled:
 get the person's approval first. External vacancies are applied to through the destination from `reveal`.
+Hiding a vacancy or a company is free and has no limit: it stops coming back in search and feeds,
+here and on the website. `--undo` brings it back.
 
 The server defines search filters. Read `hirify filter guide`, preview with `filters.preview`, refine,
 and then run the final search. Do not infer filter names from an old example.
@@ -121,6 +125,28 @@ Explicitly safe reads get bounded retries for transient network errors and 429/5
 Feedback accepts `--idempotency-key` when the server advertises caller-keyed deduplication;
 keep the same key for a deliberate retry. The CLI prints a generated request reference otherwise.
 
+## Codex and other sandboxed agents
+
+Sign in once from your normal terminal. A local agent can reuse that sign-in when it has access
+to the same configuration directory. It does not need a separate API key.
+Reading an unexpired session does not create files or change permissions. Renewing an OAuth
+session requires write access so the rotated token can be saved safely.
+
+A Windows Codex sandbox can run with a restricted token or a different Windows account. Success
+in `cmd` therefore does not prove the sandbox can access the saved sign-in. Keep credentials in
+their normal private directory. If a command is denied, let Codex request approval for that specific
+command using its normal permission mechanism. Do not disable the whole sandbox, grant `Everyone`
+access, copy `auth.json` into the project, or paste a token into chat.
+Read permission alone will not support token renewal. If approval is unavailable, report the
+restriction instead of repeatedly running login. WSL and containers have separate home directories;
+a Windows login is not automatically shared with them.
+
+Compare `hirify version`, `hirify doctor`, and `hirify auth status --json --error-format=json`
+inside the agent and in the terminal. These commands do not print tokens. `storage_unreadable`
+means reading was denied or failed; `storage_unavailable`, `storage_lock_failed`, and
+`storage_write_failed` identify preparation, locking, or saving failures. An access failure does
+not by itself mean the sign-in expired. See [Codex Windows sandbox documentation](https://learn.chatgpt.com/docs/windows/windows-sandbox).
+
 ## Configuration and diagnostics
 
 Access is stored in `auth.json` under `$XDG_CONFIG_HOME/hirify` when XDG_CONFIG_HOME is absolute,

package/bin/lib/auth.js

@@ -42,7 +42,6 @@ export function createAuth({ config, store, http, signal, output, event, secrets
   }
   async function access() {
     if (config.envKey) { secrets.add(config.envKey); return config.envKey }
-    await store.secure()
     let current = remember(store.read({ allowPending: true }))
     if (!current) throw new CliError('auth_required', 'You are not signed in. Run hirify login. For CI or servers, set HIRIFY_KEY or use hirify auth --stdin.')
     if (current.kind === 'oauth' && (current.refresh_pending || (current.expires_at && current.expires_at <= Date.now() / 1000 + 60))) current = await refresh(current)

package/bin/lib/cli.js

@@ -1,7 +1,7 @@
 import { CliError, redact, safeText } from './errors.js'
-const ARGUMENTS = { auth: '[<key>]', update: '[<version>]', 'vacancy search': '[<query>]', 'vacancy read': '<slug>', 'vacancy reveal': '<slug>', 'vacancy apply': '<slug>', 'feed show': '<id>', 'feed create': '<name>', 'feed deliver': '<id>', 'webhook create': '<name> <url>', 'feedback send': '<bug|feature> <title>', 'api call': '<capability>', 'capabilities show': '<capability>' }
+const ARGUMENTS = { auth: '[<key>]', update: '[<version>]', 'vacancy search': '[<query>]', 'vacancy read': '<slug>', 'vacancy reveal': '<slug>', 'vacancy apply': '<slug>', 'vacancy hide': '<slug>...', 'company hide': '[<name>...]', 'feed show': '<id>', 'feed create': '<name>', 'feed deliver': '<id>', 'webhook create': '<name> <url>', 'feedback send': '<bug|feature> <title>', 'api call': '<capability>', 'capabilities show': '<capability>' }
 const GLOBAL = ['json', 'fields', 'error-format', 'debug', 'timeout', 'help']
-export const BOOLEAN_FLAGS = new Set(['json', 'debug', 'help', 'force', 'no-browser', 'stdin', 'telegram', 'no-telegram', 'no-webhook', 'check', 'rollback'])
+export const BOOLEAN_FLAGS = new Set(['json', 'debug', 'help', 'force', 'no-browser', 'stdin', 'telegram', 'no-telegram', 'no-webhook', 'check', 'rollback', 'undo'])
 export const COMMANDS = {
   intro: { args: [0, 0], description: 'what this can do, and in what order' },
   version: { args: [0, 0], description: 'installed version' },
@@ -17,6 +17,8 @@ export const COMMANDS = {
   'vacancy read': { args: [1, 1], description: 'read one vacancy in full; uses a vacancy open' },
   'vacancy reveal': { args: [1, 1], description: 'get the contact or link to apply; uses a reveal' },
   'vacancy apply': { args: [1, 1], flags: ['profile', 'cover', 'cover-file'], description: 'send a real application; ask the person first' },
+  'vacancy hide': { args: [1, 100], flags: ['undo'], description: 'hide vacancies from your search and feeds; free, no limit' },
+  'company hide': { args: [0, 100], flags: ['vacancy', 'undo'], description: 'hide a company by name, or by --vacancy <slug>; free, no limit' },
   'feed list': { args: [0, 0], description: 'your saved feeds' },
   'feed show': { args: [1, 1], flags: ['limit', 'page'], description: 'vacancies in a feed' },
   'feed create': { args: [1, 1], flags: ['filters', 'telegram', 'no-telegram', 'webhook'], description: 'save a search and its delivery settings' },
@@ -99,7 +101,7 @@ export function parse(argv) {
 }
 export function help(topic = '') {
   const entries = Object.entries(COMMANDS).filter(([name]) => !topic || name === topic || name.startsWith(topic + ' '))
-  return `hirify - job search for AI agents\n\n${(entries.length ? entries : Object.entries(COMMANDS)).map(([name, spec]) => `  hirify ${(name + (ARGUMENTS[name] ? ' ' + ARGUMENTS[name] : '')).padEnd(35)} ${spec.description}${spec.flags?.length ? `\n    ${spec.flags.map(f => '--' + f + (BOOLEAN_FLAGS.has(f) ? '' : ' <value>')).join('  ')}` : ''}`).join('\n')}\n\nGlobal options: --json, --fields a,b, --error-format json|text, --timeout <seconds>, --debug, --help.\nUse -- to end options; --name=value and --name value are supported.\nLists and search are free. Vacancy read, reveal and apply have separate allowances.\nCheck them with hirify account show. Apply sends a real application: ask the person first.\nHeadless/CI: HIRIFY_KEY or hirify auth --stdin. Manual login: --no-browser.\nSSH: forward the chosen --callback-port to the same loopback port on the CLI host.\nRules for your agent: npx skills add hirifyme/hirify-cli\n`
+  return `hirify - job search for AI agents\n\n${(entries.length ? entries : Object.entries(COMMANDS)).map(([name, spec]) => `  hirify ${(name + (ARGUMENTS[name] ? ' ' + ARGUMENTS[name] : '')).padEnd(35)} ${spec.description}${spec.flags?.length ? `\n    ${spec.flags.map(f => '--' + f + (BOOLEAN_FLAGS.has(f) ? '' : ' <value>')).join('  ')}` : ''}`).join('\n')}\n\nGlobal options: --json, --fields a,b, --error-format json|text, --timeout <seconds>, --debug, --help.\nUse -- to end options; --name=value and --name value are supported.\nLists and search are free. Vacancy read, reveal and apply have separate allowances.\nCheck them with hirify account show. Apply sends a real application: ask the person first.\nLocal agents reuse saved sign-in when allowed. Token renewal needs write access.\nSandbox access denied: request permission for the command; do not copy tokens.\nHeadless/CI: HIRIFY_KEY or hirify auth --stdin. Manual login: --no-browser.\nSSH: forward the chosen --callback-port to the same loopback port on the CLI host.\nRules for your agent: npx skills add hirifyme/hirify-cli\n`
 }
 export function createOutput({ stdout = process.stdout, stderr = process.stderr, json = false, errorJSON = false, secrets = new Set() } = {}) {
   let closed = false

package/bin/lib/commands.js

@@ -290,6 +290,36 @@ async function cmdVacancyReveal(args, words) {
   })
 }
 
+/**
+ * Hide vacancies or whole companies so they stop coming back in search and feeds. The same
+ * list the website's "Hide" button writes, so it works in both directions. Free and not
+ * limited; --undo brings them back. Up to 100 per call: the server takes them in one request.
+ */
+function printHidden(d, one, many, undo) {
+  const n = count(d.updated) ?? 0
+  const noun = n === 1 ? one : many
+  console.log(undo
+    ? `${n} ${noun} unhidden.`
+    : `${n} ${noun} hidden. ${n === 1 ? 'It no longer appears' : 'They no longer appear'} in your search and feeds.`)
+  if (Array.isArray(d.not_found) && d.not_found.length) console.log(`not found: ${d.not_found.join(', ')}`)
+}
+
+async function cmdVacancyHide(args, words) {
+  if (!words.length) die('at least one vacancy slug is required: hirify vacancy hide <slug>...')
+  const undo = args.includes('--undo')
+  const body = await callCapability('vacancies.hide', { payload: { slugs: words, hidden: !undo } })
+  out(body, () => printHidden(body?.data ?? {}, 'vacancy', 'vacancies', undo))
+}
+
+async function cmdCompanyHide(args, words) {
+  const vacancy = flag(args, '--vacancy')
+  if (!words.length && !vacancy) die('name the company, or pass one of its vacancies: hirify company hide "<name>" | --vacancy <slug>')
+  const undo = args.includes('--undo')
+  const payload = { hidden: !undo, ...(words.length ? { names: words } : {}), ...(vacancy ? { slugs: [vacancy] } : {}) }
+  const body = await callCapability('companies.hide', { payload })
+  out(body, () => printHidden(body?.data ?? {}, 'company', 'companies', undo))
+}
+
 /**
  * Report a bug or ask for a feature. Free: it does not touch the reveal limit.
  *
@@ -818,6 +848,7 @@ return {
   intro: cmdIntro, skill: cmdSkill,
   'account show': cmdAccountShow,
   'vacancy search': cmdVacancySearch, 'vacancy read': cmdVacancyRead, 'vacancy reveal': cmdVacancyReveal, 'vacancy apply': cmdVacancyApply,
+  'vacancy hide': cmdVacancyHide, 'company hide': cmdCompanyHide,
   'feed list': cmdFeedList, 'feed show': cmdFeedShow, 'feed create': cmdFeedCreate, 'feed deliver': cmdFeedDeliver,
   'profile list': cmdProfileList, 'webhook list': cmdWebhookList, 'webhook create': cmdWebhookCreate,
   'feedback send': cmdFeedbackSend, 'filter guide': cmdFilterGuide, 'api call': cmdApiCall,

package/bin/lib/store.js

@@ -7,6 +7,12 @@ import { CliError, aborted } from './errors.js'
 import { DEFAULT_API, serverURL } from './config.js'
 import { delay } from './http.js'
 
+function storageError(code, operation, error) {
+  // Never include OS error messages: they may contain private paths or user input.
+  const reason = ['EACCES', 'EPERM', 'EROFS', 'ENOSPC', 'EDQUOT', 'ENOENT', 'ENOTDIR', 'ERR_ACCESS_DENIED'].includes(error?.code) ? ` (${error.code})` : ''
+  const access = operation === 'read' ? 'read access' : 'write access'
+  return new CliError(code, `Could not ${operation} the saved sign-in${reason}. This command needs ${access} to the Hirify configuration directory. If it runs in an agent sandbox, request permission for this command through the agent. Otherwise, check directory permissions and available disk space. Do not copy tokens into the project or chat.`)
+}
 function stat(path) { try { return lstatSync(path) } catch (e) { if (e.code === 'ENOENT') return null; throw e } }
 function check(path, directory = false) {
   const s = stat(path)
@@ -28,13 +34,13 @@ export function createStore(config, { signal } = {}) {
   const file = join(config.dir, 'auth.json')
   const legacy = join(config.dir, 'key')
   let compromised = false
-  let secured = false
   async function ensure() {
     try { mkdirSync(config.dir, { recursive: true, mode: 0o700 }); await makePrivate(config.dir, true, signal) }
-    catch (e) { if (signal?.aborted) throw signal.reason; if (e instanceof CliError) throw e; throw new CliError('storage_unavailable', 'Could not create a private credential directory. Check its permissions.') }
+    catch (e) { if (signal?.aborted) throw signal.reason; if (e instanceof CliError) throw e; throw storageError('storage_unavailable', 'prepare', e) }
   }
   function readRaw() {
     try {
+      check(config.dir, true)
       const stateStat = check(file)
       if (stateStat) {
         const raw = readFileSync(file, 'utf8')
@@ -50,7 +56,7 @@ export function createStore(config, { signal } = {}) {
         if (key) return { kind: 'key', issuer: DEFAULT_API, access_token: key, generation: `legacy:${createHash('sha256').update(key).digest('hex')}` }
       }
       return { kind: 'signed-out', generation: 'absent' }
-    } catch (e) { if (e instanceof CliError) throw e; throw new CliError('storage_unreadable', 'Could not read the saved sign-in. Check the credential directory permissions.') }
+    } catch (e) { if (e instanceof CliError) throw e; throw storageError('storage_unreadable', 'read', e) }
   }
   function read({ allowPending = false } = {}) {
     const state = readRaw()
@@ -76,7 +82,7 @@ export function createStore(config, { signal } = {}) {
       }
       if (process.platform !== 'win32') { const dir = openSync(config.dir, 'r'); try { fsyncSync(dir) } finally { closeSync(dir) } }
       if (check(legacy)) unlinkSync(legacy)
-    } catch (e) { if (e instanceof CliError) throw e; throw new CliError('storage_write_failed', 'Could not save the sign-in safely. Check disk space and directory permissions. You may need to sign in again.') }
+    } catch (e) { if (e instanceof CliError) throw e; throw storageError('storage_write_failed', 'save', e) }
     finally { if (fd !== undefined) closeSync(fd); try { unlinkSync(temp) } catch {} }
   }
   async function locked(fn) {
@@ -87,7 +93,7 @@ export function createStore(config, { signal } = {}) {
     while (!release) {
       aborted(signal)
       try { release = await lockfile.lock(file, { realpath: false, lockfilePath: lockPath, stale: 120000, update: 10000, onCompromised: () => { compromised = true } }) }
-      catch (e) { if (e.code !== 'ELOCKED') throw new CliError('storage_lock_failed', 'Could not lock the saved sign-in. Check directory permissions.'); await delay(40 + Math.random() * 80, signal) }
+      catch (e) { if (e.code !== 'ELOCKED') throw storageError('storage_lock_failed', 'lock', e); await delay(40 + Math.random() * 80, signal) }
     }
     try { aborted(signal); return await fn() } finally { await release().catch(() => {}) }
   }
@@ -113,6 +119,5 @@ export function createStore(config, { signal } = {}) {
       return state.generation
     })
   }
-  async function secure() { if (secured) return; await ensure(); for (const path of [file, legacy]) if (check(path)) await makePrivate(path, false, signal); secured = true }
-  return { file, read, readRaw, write, locked, commit, logout, beginLogin, secure }
+  return { file, read, readRaw, write, locked, commit, logout, beginLogin }
 }

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "hirify-cli",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "hirify-cli",
-      "version": "0.5.0",
+      "version": "0.5.2",
       "license": "Apache-2.0",
       "dependencies": {
         "cross-spawn": "7.0.6",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hirify-cli",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "Hirify CLI for AI agents: browser sign-in, job feeds, search, reading a vacancy in full, contacts to apply to, and applying on Hirify.",
   "bin": {
     "hirify": "bin/hirify.js"
@@ -10,7 +10,8 @@
     "build": "node scripts/build.mjs",
     "test:package": "node scripts/verify-package.mjs",
     "prepublishOnly": "node scripts/prepublish-check.mjs",
-    "test:install": "node scripts/install-update-smoke.mjs"
+    "test:install": "node scripts/install-update-smoke.mjs",
+    "test:codex": "node scripts/codex-sandbox-smoke.mjs"
   },
   "type": "module",
   "dependencies": {

package/skills/hirify/SKILL.md

@@ -17,8 +17,9 @@ for reproducible work use an exact version and `HIRIFY_NO_AUTO_UPDATE=1`.
 
 A person runs `hirify login` and confirms the printed link. The CLI tries a browser only when
 appropriate. Do not run login for them. `--no-browser` is manual callback login, not device flow.
-SSH needs `--callback-port` with a matching SSH local port forward. For agents, CI and containers,
-use `HIRIFY_KEY` or pipe a key to `hirify auth --stdin`; never put a key in a command, log or chat.
+SSH needs `--callback-port` with a matching SSH local port forward. Local agents reuse the person's
+saved sign-in when permitted to access the same configuration directory. CI and separate containers
+can use `HIRIFY_KEY` or `hirify auth --stdin`; never put a key in a command, log or chat.
 `hirify auth status --json` identifies the local source. Environment keys override saved access;
 logout is local and does not unset them. Use `hirify login --force` to replace expired access.
 
@@ -48,6 +49,7 @@ no permission. Sending, saving and configuring do.
 3. `vacancy read <slug>` to assess fit from the full text rather than a headline.
 4. `vacancy reveal <slug>` only for vacancies that still fit after reading.
 5. Apply only after the person's approval and the rules below.
+6. `vacancy hide` / `company hide` what the user rejected; free, unlimited.
 
 ## Searching
 
@@ -107,7 +109,13 @@ errors; do not combine it with debug if expecting one object. Exit 0 means succe
 2 unsupported server manifest, 130/143 interruption. Read the stable error code and message.
 
 - `interaction_required`: ask the person to sign in or configure a key; do not wait on browser login.
-- Authentication failure: inspect `auth status`, then ask for `login --force`. Never expose a token.
+- Storage access failure: compare `doctor`, `version`, and `auth status` with the normal terminal.
+  Request permission for the specific command through the agent's approval mechanism. Reading a
+  current token needs read access; renewal needs write access. Do not treat storage errors as an
+  expired login, copy credentials into the workspace, broaden Windows ACLs, or disable the sandbox.
+  Codex on Windows may use a different account; WSL/containers do not share the Windows home.
+- Authentication failure: inspect `auth status`; ask for `login --force` only when renewal requires
+  a new sign-in. Never expose a token.
 - 403: permission or plan restriction. 429: pace or a named allowance; inspect `account show`.
 - Network/TLS/proxy failure: fix connectivity or trust configuration; never disable TLS verification.
 - `outcome_unknown`: a metered action or mutation may have succeeded. Check before repeating;