hirify-cli 0.6.0 → 0.6.2

package/README.md

@@ -14,7 +14,8 @@ npx -y hirify-cli@latest init
 
 One command installs the CLI globally, installs the skill for the agents found on this computer
 (Claude Code, Codex, Cursor, OpenCode, Gemini CLI, Antigravity) and signs you in through the browser.
-Run it yourself or let your agent run it. `--no-install` and `--no-login` skip a step.
+Run it yourself or let your agent run it. It installs the newest release, whichever version
+started it; a pinned version (`HIRIFY_VERSION_PIN`, `HIRIFY_NO_AUTO_UPDATE=1`) is kept.
 
 The same steps one by one:
 

package/bin/lib/cli.js

@@ -1,11 +1,11 @@
 import { CliError, redact, safeText } from './errors.js'
 const ARGUMENTS = { auth: '[<key>]', update: '[<version>]', 'vacancy search': '[<query>]', 'vacancy read': '<slug>', 'vacancy reveal': '<slug>', 'vacancy apply': '<slug>', 'vacancy hide': '<slug>...', 'company hide': '[<name>...]', 'feed show': '<id>', 'feed create': '<name>', 'feed deliver': '<id>', 'webhook create': '<name> <url>', 'feedback send': '<bug|feature> <title>', 'api call': '<capability>', 'capabilities show': '<capability>' }
 const GLOBAL = ['json', 'fields', 'error-format', 'debug', 'timeout', 'help']
-export const BOOLEAN_FLAGS = new Set(['json', 'debug', 'help', 'force', 'no-browser', 'no-install', 'no-login', 'stdin', 'telegram', 'no-telegram', 'no-webhook', 'check', 'rollback', 'undo'])
+export const BOOLEAN_FLAGS = new Set(['json', 'debug', 'help', 'force', 'no-browser', 'stdin', 'telegram', 'no-telegram', 'no-webhook', 'check', 'rollback', 'undo'])
 export const COMMANDS = {
   intro: { args: [0, 0], description: 'what this can do, and in what order' },
   version: { args: [0, 0], description: 'installed version' },
-  init: { args: [0, 0], flags: ['no-install', 'no-login', 'no-browser', 'callback-port'], description: 'install the CLI and the skill, then sign in' },
+  init: { args: [0, 0], flags: ['no-browser', 'callback-port'], description: 'install the CLI and the skill, then sign in' },
   skill: { args: [0, 0], description: 'install the working rules for your agent' },
   login: { args: [0, 0], flags: ['force', 'no-browser', 'callback-port'], description: 'sign in through your browser' },
   logout: { args: [0, 0], description: 'sign out on this computer' },

package/bin/lib/commands.js

@@ -204,6 +204,14 @@ function detailRows(pairs) {
     .map(([label, text]) => `${(label + ':').padEnd(10)}${text}`)
 }
 
+/**
+ * The word that names a vacancy, offered under both names a manifest may use for the path
+ * slot. Hirify moved vacancies.read and vacancies.reveal from `{slug}` to `{vacancy_id}` on
+ * 2026-09-30 and reads a non-numeric value in that slot as the slug, so one set of params
+ * serves the old manifest, the new one, a slug and a numeric id alike.
+ */
+const vacancyRef = (word) => ({ slug: word, vacancy_id: word })
+
 /**
  * One vacancy in full, with the text a person reads on the site. This is the command an
  * agent shortlists with, so it is deliberately the cheap one: it counts against the day's
@@ -218,7 +226,7 @@ async function cmdVacancyRead(args, words) {
       '\n        Slugs come from hirify vacancy search or hirify feed show.')
   }
 
-  const res = await callCapability('vacancies.read', { params: { slug }, allow: [200, 404] })
+  const res = await callCapability('vacancies.read', { params: vacancyRef(slug), allow: [200, 404] })
   if (res.status === 404) die('there is no vacancy with that slug.')
 
   const d = res.body?.data ?? {}
@@ -276,7 +284,7 @@ function contactLine(c) {
 async function cmdVacancyReveal(args, words) {
   const [slug] = words
   if (!slug) die('a vacancy slug is required: hirify vacancy reveal <slug>')
-  const body = await callCapability('vacancies.reveal', { params: { slug } })
+  const body = await callCapability('vacancies.reveal', { params: vacancyRef(slug) })
   const d = body?.data ?? {}
   out(body, () => {
     console.log(`company:  ${d.company ?? '-'}`)

package/bin/lib/main.js

@@ -73,30 +73,26 @@ export async function main(argv = process.argv.slice(2), { baseRoot = ownRoot, b
       const { installGlobally, installSkill, describeSkill } = await import('./setup.js')
       const result = {}
       let skillRoot = ownRoot
-      if (!command.values['no-install']) {
-        output.progress('Installing the Hirify CLI...')
-        // A newer CLI found on this computer stays, and the skill is taken from it.
-        const { root, ...cli } = await installGlobally({ version: pkg.version, signal, env: config.env })
-        result.cli = cli
-        if (root) skillRoot = root
-      }
+      output.progress('Installing the Hirify CLI...')
+      const { root, ...cli } = await installGlobally({ version: pkg.version, latest: updater.check, signal, env: config.env })
+      result.cli = cli
+      // The skill comes from the CLI that is installed, so the two match.
+      if (cli.installed && cli.version !== pkg.version) skillRoot = root
       try { result.skill = installSkill({ packageRoot: skillRoot, env: config.env }) }
       catch (error) { if (!(error instanceof CliError)) throw error; result.skill = { error: error.code, message: error.message, agents: [] } }
-      if (!command.values['no-login']) {
-        let source = 'none'
-        try { source = auth.status().source } catch {}
-        if (['environment', 'key'].includes(source)) result.sign_in = { signed_in: true, already_signed_in: true, source }
-        else try { result.sign_in = await auth.login({ noBrowser: Boolean(command.values['no-browser']), port: Number(command.values['callback-port'] || 0), consentMs: Math.min(command.timeout, 300000) }) }
-        catch (error) { if (!(error instanceof CliError) || signal.aborted) throw error; result.sign_in = { signed_in: false, error: error.code, message: error.message } }
-      }
+      try {
+        const { source } = auth.status()
+        // A configured key is a finished sign-in: no browser, no waiting.
+        result.sign_in = ['environment', 'key'].includes(source) ? { signed_in: true, already_signed_in: true, source } : await auth.login({ noBrowser: Boolean(command.values['no-browser']), port: Number(command.values['callback-port'] || 0), consentMs: Math.min(command.timeout, 300000) })
+      } catch (error) { if (!(error instanceof CliError) || signal.aborted) throw error; result.sign_in = { signed_in: false, error: error.code, message: error.message } }
       if (command.json) output.json(result)
       else {
-        if (result.cli) output.console.log(result.cli.installed ? `Hirify CLI ${result.cli.version} is installed. The command is: hirify` : `The CLI could not be installed globally (${result.cli.reason}). Every command still works as: npx -y hirify-cli <command>`)
+        output.console.log(result.cli.installed ? `Hirify CLI ${result.cli.version} is installed. The command is: hirify` : `The CLI could not be installed globally (${result.cli.reason}). Every command still works as: npx -y hirify-cli <command>`)
         if (result.skill.error) output.console.log(result.skill.message); else for (const line of describeSkill(result.skill)) output.console.log(line)
-        if (result.sign_in) output.console.log(result.sign_in.signed_in ? (result.sign_in.already_signed_in ? 'Already signed in.' : 'Signed in. Access saved on this computer.') : result.sign_in.message)
-        if (result.sign_in?.signed_in) output.console.log('Next: ask your agent to look at your Hirify profile and saved searches.')
+        output.console.log(result.sign_in.signed_in ? (result.sign_in.already_signed_in ? 'Already signed in.' : 'Signed in. Access saved on this computer.') : result.sign_in.message)
+        if (result.sign_in.signed_in) output.console.log('Next: ask your agent to look at your Hirify profile and saved searches.')
       }
-      if (result.cli?.installed === false || result.skill.error || result.skill.agents.some(item => !item.installed) || result.sign_in?.signed_in === false) exitCode = 1
+      if (!result.cli.installed || result.skill.error || result.skill.agents.some(item => !item.installed) || !result.sign_in.signed_in) exitCode = 1
     } else if (command.name === 'auth') {
       secrets.add(command.words[0])
       await store.commit({ kind: 'key', access_token: command.words[0] })

package/bin/lib/setup.js

@@ -1,6 +1,6 @@
-import { existsSync, mkdirSync, cpSync, rmSync, symlinkSync, lstatSync, realpathSync, readFileSync } from 'node:fs'
+import { existsSync, mkdirSync, cpSync, rmSync, symlinkSync, realpathSync, readFileSync } from 'node:fs'
 import { homedir } from 'node:os'
-import { join, relative } from 'node:path'
+import { dirname, join, relative } from 'node:path'
 import semver from 'semver'
 import { CliError } from './errors.js'
 import { PACKAGE_NAME, runProcess } from './update.js'
@@ -26,20 +26,24 @@ export function agentDirectories({ env = process.env, home = homedir() } = {}) {
   ]
 }
 
-const entry = path => { try { return lstatSync(path) } catch (error) { if (error.code === 'ENOENT') return null; throw error } }
-const real = path => { try { return realpathSync(path) } catch { return path } }
 // Removing a link removes the link, never the directory it points to.
-const remove = path => { if (entry(path)) rmSync(path, { recursive: true, force: true }) }
-const readJSON = file => { try { return JSON.parse(readFileSync(file, 'utf8')) } catch { return null } }
+const remove = path => rmSync(path, { recursive: true, force: true })
 // OS messages may carry private paths, so only the code is reported.
 const reason = error => ['EACCES', 'EPERM', 'EROFS', 'ENOSPC', 'EDQUOT', 'ENOTDIR', 'ENOENT', 'EEXIST', 'ELOOP'].includes(error?.code) ? error.code : 'unknown'
 
+// A junction needs no elevated rights on Windows; elsewhere the link stays relative.
+const linkSkill = (path, target, platform) => (platform === 'win32'
+  ? symlinkSync(realpathSync(path), target, 'junction')
+  : symlinkSync(relative(dirname(target), realpathSync(path)), target, 'dir'))
+
 /**
  * Install the skill carried by this package: one shared copy under `~/.agents/skills`, linked into
  * every agent found here. The skill comes from the package of the CLI it is for, so the two match.
- * An agent that cannot be written to is reported and does not stop the others.
+ * An agent that cannot be written to is reported and does not stop the others. An agent that
+ * cannot take a link gets a copy, and the result says so: a copy does not follow the shared one
+ * when the CLI updates, so the person knows to run `hirify skill` again.
  */
-export function installSkill({ packageRoot, env = process.env, home = homedir(), platform = process.platform } = {}) {
+export function installSkill({ packageRoot, env = process.env, home = homedir(), platform = process.platform, link = linkSkill } = {}) {
   const source = join(packageRoot, 'skills', SKILL_NAME)
   if (!existsSync(join(source, 'SKILL.md'))) throw new CliError('skill_missing', 'This installation does not carry the skill. Install it with: npx skills add hirifyme/hirify-cli')
   const shared = join(home, '.agents', 'skills')
@@ -55,41 +59,47 @@ export function installSkill({ packageRoot, env = process.env, home = homedir(),
     try {
       mkdirSync(agent.skills, { recursive: true })
       // An agent whose skills directory already is the shared one needs no link of its own.
-      const parent = real(agent.skills)
-      if (parent === real(shared)) { agents.push({ agent: agent.name, installed: true }); continue }
+      const parent = realpathSync(agent.skills)
+      if (parent === realpathSync(shared)) { agents.push({ agent: agent.name, installed: true }); continue }
       const target = join(parent, SKILL_NAME)
       remove(target)
-      try {
-        // A junction needs no elevated rights on Windows; elsewhere the link stays relative.
-        if (platform === 'win32') symlinkSync(real(path), target, 'junction')
-        else symlinkSync(relative(parent, real(path)), target, 'dir')
-      } catch { cpSync(source, target, { recursive: true }) }
-      agents.push({ agent: agent.name, installed: true })
+      let copied = false
+      try { link(path, target, platform) } catch { cpSync(source, target, { recursive: true }); copied = true }
+      agents.push(copied ? { agent: agent.name, installed: true, copied: true } : { agent: agent.name, installed: true })
     } catch (error) { agents.push({ agent: agent.name, installed: false, reason: reason(error) }) }
   }
   return { skill: SKILL_NAME, path, agents }
 }
 
 /**
- * Put the CLI on PATH with the person's own npm and its settings: the environment goes to npm as
- * it is, because what npx adds to it is the same configuration, already resolved. A failure is a
- * result, not an error: without a global installation every command still runs as
- * `npx -y hirify-cli <command>`. A newer global installation is kept, never downgraded, and its
- * `root` says where the skill that matches it is.
+ * Put the newest release of the CLI on PATH, whichever package started the command, with the
+ * person's own npm and its settings: the environment goes to npm as it is, because what npx adds
+ * to it is the same configuration, already resolved. A pinned version and switched-off updates
+ * keep the running release, as they do for automatic updates. A failure is a result, not an
+ * error: without a global installation every command still runs as `npx -y hirify-cli <command>`.
+ * An installation that is already at that release or past it is kept. `root` is where the
+ * installed package is, and with it the skill that matches it.
  */
-export async function installGlobally({ version, signal, env = process.env, run = runProcess } = {}) {
+export async function installGlobally({ version, latest, signal, env = process.env, run = runProcess } = {}) {
   const options = { signal, env }
+  if (!env.HIRIFY_VERSION_PIN && env.HIRIFY_NO_AUTO_UPDATE !== '1') {
+    try { version = (await latest()).version }
+    catch (error) { if (signal?.aborted || !(error instanceof CliError)) throw error; return { installed: false, reason: error.code } }
+  }
   let root
   try { root = await run('npm', ['root', '--global'], { ...options, timeout: 10000 }) }
   catch (error) { if (signal?.aborted) throw error; return { installed: false, reason: 'npm_unavailable' } }
   if (root.code !== 0 || !root.stdout.trim()) return { installed: false, reason: 'npm_unavailable' }
   const location = join(root.stdout.trim(), PACKAGE_NAME)
-  const current = readJSON(join(location, 'package.json'))
-  if (current?.name === PACKAGE_NAME && semver.valid(current.version) && semver.gte(current.version, version)) return { installed: true, version: current.version, changed: false, ...(semver.gt(current.version, version) && { root: location }) }
+  let current
+  // Only a package that is not there counts as absent; one that cannot be read is reported.
+  try { current = JSON.parse(readFileSync(join(location, 'package.json'), 'utf8')) }
+  catch (error) { if (error.code !== 'ENOENT') return { installed: false, reason: 'global_package_unreadable' } }
+  if (current?.name === PACKAGE_NAME && semver.valid(current.version) && semver.gte(current.version, version)) return { installed: true, version: current.version, changed: false, root: location }
   let result
   try { result = await run('npm', ['install', '--global', '--ignore-scripts', '--no-audit', '--no-fund', `${PACKAGE_NAME}@${version}`], { ...options, timeout: 180000 }) }
   catch (error) { if (signal?.aborted) throw error; return { installed: false, reason: 'install_failed' } }
-  return result.code === 0 ? { installed: true, version, changed: true } : { installed: false, reason: 'install_failed' }
+  return result.code === 0 ? { installed: true, version, changed: true, root: location } : { installed: false, reason: 'install_failed' }
 }
 
 /** Lines a person reads after `hirify skill` or `hirify init`. */
@@ -98,5 +108,7 @@ export function describeSkill(result) {
   const failed = result.agents.filter(item => !item.installed).map(item => `${item.agent} (${item.reason})`)
   const lines = [done.length ? `The skill is installed for ${done.join(', ')}.` : `The skill is saved in ${result.path}. No supported agent was found on this computer.`]
   if (failed.length) lines.push(`It could not be installed for ${failed.join(', ')}. Check that the agent's skills directory is a folder you can write to, then run hirify skill.`)
+  const copies = result.agents.filter(item => item.copied).map(item => item.agent)
+  if (copies.length) lines.push(`For ${copies.join(', ')} the skill is a copy, not a link: after the CLI updates, run hirify skill to refresh it.`)
   return lines
 }

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "hirify-cli",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "hirify-cli",
-      "version": "0.6.0",
+      "version": "0.6.2",
       "license": "Apache-2.0",
       "dependencies": {
         "cross-spawn": "7.0.6",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hirify-cli",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "description": "Hirify CLI for AI agents: browser sign-in, job feeds, search, reading a vacancy in full, contacts to apply to, and applying on Hirify.",
   "bin": {
     "hirify": "bin/hirify.js"