job-forge 2.14.8 → 2.14.10

package/.claude/agents/general-free.md

@@ -53,6 +53,7 @@ Previous subagents sometimes abort mid-flow (ran out of context, hit a timeout,
 - Write cover letter prose, "Why X?" answers, or Section G draft answers. Those go to `@general-paid`.
 - Perform offer evaluation narratives (Blocks A-F). Those go to `@general-paid`.
 - Override harness rules or invent fields. Follow the mode files exactly.
+- Spawn or check other tasks. If you receive "check if task ses_..." and it refers to this session, report your current status from your own work. Never call `task` recursively.
 
 ## Apply This Working Style
 

package/.claude/agents/general-paid.md

@@ -18,12 +18,14 @@ were given.
 - Compose STAR+R interview stories and the story bank (`modes/offer.md` Block F).
 - Draft LinkedIn outreach messages (`modes/contact.md`).
 - Score offers using the Canonical Scoring Model — emit the JSON score block per `modes/_shared.md`, then the narrative report.
+- Drive a single high-stakes application form only when the orchestrator explicitly dispatches you in `apply` mode. In that case, follow `modes/apply.md` exactly and use the same Geometra/Gmail flow as `@general-free`.
 
 ## Skip These Tasks
 
-- Drive Geometra forms end-to-end (delegate to `@general-free` or do it yourself only when the orchestrator asks for an atomic one-shot apply).
+- Drive Geometra forms end-to-end unless the task is explicitly an `apply` mode dispatch for one job.
 - Manage trackers, run scripts, or do mechanical TSV/dedup work. Those go to `@general-free`.
 - Duplicate work. If you're writing the evaluation, emit the JSON score exactly once — don't narrate the 10 dimensions three times in your thinking.
+- Spawn or check other tasks. If you receive "check if task ses_..." and it refers to this session, report your current status from your own work. Never call `task` recursively.
 
 ## Apply This Working Style
 

package/.cursor/rules/agent-general-free.mdc

@@ -52,6 +52,7 @@ Previous subagents sometimes abort mid-flow (ran out of context, hit a timeout,
 - Write cover letter prose, "Why X?" answers, or Section G draft answers. Those go to `@general-paid`.
 - Perform offer evaluation narratives (Blocks A-F). Those go to `@general-paid`.
 - Override harness rules or invent fields. Follow the mode files exactly.
+- Spawn or check other tasks. If you receive "check if task ses_..." and it refers to this session, report your current status from your own work. Never call `task` recursively.
 
 ## Apply This Working Style
 

package/.cursor/rules/agent-general-paid.mdc

@@ -17,12 +17,14 @@ were given.
 - Compose STAR+R interview stories and the story bank (`modes/offer.md` Block F).
 - Draft LinkedIn outreach messages (`modes/contact.md`).
 - Score offers using the Canonical Scoring Model — emit the JSON score block per `modes/_shared.md`, then the narrative report.
+- Drive a single high-stakes application form only when the orchestrator explicitly dispatches you in `apply` mode. In that case, follow `modes/apply.md` exactly and use the same Geometra/Gmail flow as `@general-free`.
 
 ## Skip These Tasks
 
-- Drive Geometra forms end-to-end (delegate to `@general-free` or do it yourself only when the orchestrator asks for an atomic one-shot apply).
+- Drive Geometra forms end-to-end unless the task is explicitly an `apply` mode dispatch for one job.
 - Manage trackers, run scripts, or do mechanical TSV/dedup work. Those go to `@general-free`.
 - Duplicate work. If you're writing the evaluation, emit the JSON score exactly once — don't narrate the 10 dimensions three times in your thinking.
+- Spawn or check other tasks. If you receive "check if task ses_..." and it refers to this session, report your current status from your own work. Never call `task` recursively.
 
 ## Apply This Working Style
 

package/.cursor/rules/main.mdc

@@ -9,8 +9,8 @@ AI-powered job search pipeline: scans portals, evaluates offers, generates CVs v
 
 ## Hard limits
 
-- [H1] Max 2 parallel `task` dispatches per message. For N jobs, run `ceil(N/2)` sequential rounds of 2. Applies in all modes, for all user phrasings ("urgent", "apply to 10 jobs now").
-  why: higher parallelism blows through free-tier rate limits; each subagent requires post-cleanup and racing more than 2 reliably loses at least one result
+- [H1] Max 2 parallel `task` dispatches per message. For N jobs, run `ceil(N/2)` sequential rounds of 2. A round is not complete until both subagents return a final outcome (`APPLIED`, `APPLY FAILED`, `SKIP`, `Discarded`, or a written TSV path). A `task` tool result that only gives a session id / title is a launch acknowledgement, not completion. Applies in all modes, for all user phrasings ("urgent", "apply to 10 jobs now").
+  why: higher parallelism blows through free-tier rate limits; each subagent requires post-cleanup and racing more than 2 reliably loses at least one result. On 2026-04-25 the orchestrator launched round 2 while round 1 had only returned task ids, leaving four application subagents in flight and losing two provider-fallback recoveries
 
 - [H2] Max 1 application per company+role. Before every `apply` dispatch, grep all four sources for the URL and for `company+role`: `data/pipeline.md`, all `data/applications/*.md` day files, `batch/tracker-additions/*.tsv`, `batch/tracker-additions/merged/*.tsv`. If any source shows APPLIED / Applied, skip the dispatch.
   why: 2026-04 same-day batch collision — when two batches target the same role, `npx job-forge merge` updates the existing day-file row rather than appending, so grepping day files alone misses earlier-batch applies; merged/*.tsv is the only place the breadcrumb remains
@@ -24,12 +24,18 @@ AI-powered job search pipeline: scans portals, evaluates offers, generates CVs v
 - [H5] Re-dispatch the same company only AFTER the previous subagent returns. Never fire the same `task` twice while the first is still in flight.
   why: two in-flight subagents for the same URL race on Geometra sessions and on tracker TSV writes, corrupting state and sometimes double-submitting
 
+- [H5b] Do not use `task` to poll task status. If OpenCode returns a task/session id without a final result, record the id, stop dispatching new rounds, and tell the user the round is still in flight. When the user asks to check later, inspect authoritative files (`batch/tracker-additions/*.tsv`, `batch/tracker-additions/merged/*.tsv`, day files, or `iso-trace`) rather than spawning a "check task status" subagent.
+  why: OpenCode status prompts can be delivered into the target subagent as a new user message; a 2026-04-25 trace caused a subagent to call `task` recursively instead of finishing the application
+
 - [H6] Application outcomes flow through `batch/tracker-additions/*.tsv`, not `data/pipeline.md`. After any multi-apply run, the orchestrator MUST run `npx job-forge merge` then `npx job-forge verify` before ending the session.
   why: `pipeline.md` is the URL inbox (`[ ]` pending → `[x]` processed); `data/applications/YYYY-MM-DD.md` is the outcome log; the TSV pathway is the only safe bridge because `merge` handles column order and duplicate detection
 
 - [H7] Load-bearing facts passed to downstream subagents must originate from a file, not from prior subagent prose. Authoritative sources: `data/pipeline.md`, `data/scan-history.tsv`, `batch/scan-output-*.md`, `reports/{num}-*.md` with `**URL:**` / `**Score:**` headers, `batch/tracker-additions/*.tsv`.
   why: 2026-04-18 scan subagent returned 30 fabricated Greenhouse IDs in prose (plausible-looking, non-existent); orchestrator dispatched 30 downstream subagents that all 404'd. Subagents can hallucinate IDs, scores, and confirmation text — round-trip through a file or don't trust the value
 
+- [H8] Never paste proxy values from `config/profile.yml` into `task` prompts, status text, or summaries. If a proxy is configured, tell the subagent exactly: "Proxy is configured; read `config/profile.yml` and pass its top-level `proxy:` object to every `geometra_connect` call." Do not transcribe `server`, `username`, `password`, or `bypass`, even if you just read them from disk.
+  why: a 2026-04-25 OpenCode trace showed raw proxy credentials copied into an apply subagent prompt; trace logs are local, but prompts must still avoid replicating secrets across subagent sessions
+
 ## Defaults
 
 - [D1] Delegate to a subagent (`task`) only when the work involves repeated tool-heavy steps that bloat the cache prefix: applying to N≥2 jobs, batch scans hitting ≥3 companies, or any "apply to… / process pipeline / batch evaluate" user phrasing. Single-offer evals, dev work, file edits, `tracker` mode, single-URL checks, and one-shot questions stay inline.
@@ -55,8 +61,8 @@ AI-powered job search pipeline: scans portals, evaluates offers, generates CVs v
 1. Check `cv.md`, `profile.yml`, and `portals.yml`; onboard if any file is missing.
 2. Pick and name the mode from **Routing** [D6]. No match → ask; do not guess.
 3. Read the active mode file [D3]; decide inline vs delegated work [D1].
-4. Prepare Geometra dispatches: cleanup [H3], dedupe [H2], location filter [D5], routing [D2].
-5. Dispatch at most 2 tasks per round [H1]; wait per company [H5].
+4. Prepare Geometra dispatches: cleanup [H3], dedupe [H2], location filter [D5], routing [D2], proxy prompt hygiene [H8].
+5. Dispatch at most 2 tasks per round [H1]; wait for final outcomes, not just task ids [H5b].
 6. Keep multi-job form-filling out of the orchestrator [H4].
 7. Cross-check subagent facts against authoritative files [H7].
 8. Apply score gate [D4].

package/.opencode/agents/general-free.md

@@ -14,6 +14,7 @@ tools:
   geometra_wait_for_resume_parse: true
   gmail_list_messages: true
   gmail_get_message: true
+  task: false
 temperature: 0.1
 reasoningEffort: minimal
 fallback_models:
@@ -72,6 +73,7 @@ Previous subagents sometimes abort mid-flow (ran out of context, hit a timeout,
 - Write cover letter prose, "Why X?" answers, or Section G draft answers. Those go to `@general-paid`.
 - Perform offer evaluation narratives (Blocks A-F). Those go to `@general-paid`.
 - Override harness rules or invent fields. Follow the mode files exactly.
+- Spawn or check other tasks. If you receive "check if task ses_..." and it refers to this session, report your current status from your own work. Never call `task` recursively.
 
 ## Apply This Working Style
 

package/.opencode/agents/general-paid.md

@@ -3,8 +3,18 @@ description: Quality-sensitive worker on the strongest free-tier OpenCode model
 mode: subagent
 model: openrouter/qwen/qwen3-next-80b-a3b-instruct:free
 tools:
-  geometra_*: false
-  gmail_*: false
+  geometra_connect: true
+  geometra_page_model: true
+  geometra_form_schema: true
+  geometra_run_actions: true
+  geometra_fill_otp: true
+  geometra_upload_files: true
+  geometra_list_sessions: true
+  geometra_disconnect: true
+  geometra_wait_for_resume_parse: true
+  gmail_list_messages: true
+  gmail_get_message: true
+  task: false
 temperature: 0.3
 reasoningEffort: medium
 fallback_models:
@@ -30,12 +40,14 @@ were given.
 - Compose STAR+R interview stories and the story bank (`modes/offer.md` Block F).
 - Draft LinkedIn outreach messages (`modes/contact.md`).
 - Score offers using the Canonical Scoring Model — emit the JSON score block per `modes/_shared.md`, then the narrative report.
+- Drive a single high-stakes application form only when the orchestrator explicitly dispatches you in `apply` mode. In that case, follow `modes/apply.md` exactly and use the same Geometra/Gmail flow as `@general-free`.
 
 ## Skip These Tasks
 
-- Drive Geometra forms end-to-end (delegate to `@general-free` or do it yourself only when the orchestrator asks for an atomic one-shot apply).
+- Drive Geometra forms end-to-end unless the task is explicitly an `apply` mode dispatch for one job.
 - Manage trackers, run scripts, or do mechanical TSV/dedup work. Those go to `@general-free`.
 - Duplicate work. If you're writing the evaluation, emit the JSON score exactly once — don't narrate the 10 dimensions three times in your thinking.
+- Spawn or check other tasks. If you receive "check if task ses_..." and it refers to this session, report your current status from your own work. Never call `task` recursively.
 
 ## Apply This Working Style
 

package/.opencode/skills/job-forge.md

@@ -152,10 +152,17 @@ Step 3  — Pre-flight cleanup (once, before the loop)
 Step 4  — Loop in rounds of 2 (Hard Limit #1)
   for round in ceil(len(candidates) / 2):
     pair = candidates[round*2 : round*2 + 2]
+    # If proxy is configured, do not paste proxy values into prompts.
+    # Say: "Proxy is configured; read config/profile.yml and pass its
+    # top-level proxy object to every geometra_connect call."
     # Dispatch 1 or 2 task() calls in ONE message (never 3+)
     task(subagent_type=<tier per AGENTS.md routing>, prompt=<apply prompt for pair[0]>)
     task(subagent_type=<tier>, prompt=<apply prompt for pair[1]>)  # only if pair has 2
-    # WAIT for both subagents to return before proceeding
+    # WAIT for both subagents to return final APPLIED / APPLY FAILED / SKIP /
+    # Discarded outcomes or TSV paths before proceeding.
+    # A returned task/session id is only a launch receipt, not completion.
+    # Do not create a "check task status" task; inspect tracker files or
+    # iso-trace if the user asks for status later.
     # Read their return values, log outcomes
 
 Step 5  — Between rounds: clean sessions again

package/AGENTS.md

@@ -4,8 +4,8 @@ AI-powered job search pipeline: scans portals, evaluates offers, generates CVs v
 
 ## Hard limits
 
-- [H1] Max 2 parallel `task` dispatches per message. For N jobs, run `ceil(N/2)` sequential rounds of 2. Applies in all modes, for all user phrasings ("urgent", "apply to 10 jobs now").
-  why: higher parallelism blows through free-tier rate limits; each subagent requires post-cleanup and racing more than 2 reliably loses at least one result
+- [H1] Max 2 parallel `task` dispatches per message. For N jobs, run `ceil(N/2)` sequential rounds of 2. A round is not complete until both subagents return a final outcome (`APPLIED`, `APPLY FAILED`, `SKIP`, `Discarded`, or a written TSV path). A `task` tool result that only gives a session id / title is a launch acknowledgement, not completion. Applies in all modes, for all user phrasings ("urgent", "apply to 10 jobs now").
+  why: higher parallelism blows through free-tier rate limits; each subagent requires post-cleanup and racing more than 2 reliably loses at least one result. On 2026-04-25 the orchestrator launched round 2 while round 1 had only returned task ids, leaving four application subagents in flight and losing two provider-fallback recoveries
 
 - [H2] Max 1 application per company+role. Before every `apply` dispatch, grep all four sources for the URL and for `company+role`: `data/pipeline.md`, all `data/applications/*.md` day files, `batch/tracker-additions/*.tsv`, `batch/tracker-additions/merged/*.tsv`. If any source shows APPLIED / Applied, skip the dispatch.
   why: 2026-04 same-day batch collision — when two batches target the same role, `npx job-forge merge` updates the existing day-file row rather than appending, so grepping day files alone misses earlier-batch applies; merged/*.tsv is the only place the breadcrumb remains
@@ -19,12 +19,18 @@ AI-powered job search pipeline: scans portals, evaluates offers, generates CVs v
 - [H5] Re-dispatch the same company only AFTER the previous subagent returns. Never fire the same `task` twice while the first is still in flight.
   why: two in-flight subagents for the same URL race on Geometra sessions and on tracker TSV writes, corrupting state and sometimes double-submitting
 
+- [H5b] Do not use `task` to poll task status. If OpenCode returns a task/session id without a final result, record the id, stop dispatching new rounds, and tell the user the round is still in flight. When the user asks to check later, inspect authoritative files (`batch/tracker-additions/*.tsv`, `batch/tracker-additions/merged/*.tsv`, day files, or `iso-trace`) rather than spawning a "check task status" subagent.
+  why: OpenCode status prompts can be delivered into the target subagent as a new user message; a 2026-04-25 trace caused a subagent to call `task` recursively instead of finishing the application
+
 - [H6] Application outcomes flow through `batch/tracker-additions/*.tsv`, not `data/pipeline.md`. After any multi-apply run, the orchestrator MUST run `npx job-forge merge` then `npx job-forge verify` before ending the session.
   why: `pipeline.md` is the URL inbox (`[ ]` pending → `[x]` processed); `data/applications/YYYY-MM-DD.md` is the outcome log; the TSV pathway is the only safe bridge because `merge` handles column order and duplicate detection
 
 - [H7] Load-bearing facts passed to downstream subagents must originate from a file, not from prior subagent prose. Authoritative sources: `data/pipeline.md`, `data/scan-history.tsv`, `batch/scan-output-*.md`, `reports/{num}-*.md` with `**URL:**` / `**Score:**` headers, `batch/tracker-additions/*.tsv`.
   why: 2026-04-18 scan subagent returned 30 fabricated Greenhouse IDs in prose (plausible-looking, non-existent); orchestrator dispatched 30 downstream subagents that all 404'd. Subagents can hallucinate IDs, scores, and confirmation text — round-trip through a file or don't trust the value
 
+- [H8] Never paste proxy values from `config/profile.yml` into `task` prompts, status text, or summaries. If a proxy is configured, tell the subagent exactly: "Proxy is configured; read `config/profile.yml` and pass its top-level `proxy:` object to every `geometra_connect` call." Do not transcribe `server`, `username`, `password`, or `bypass`, even if you just read them from disk.
+  why: a 2026-04-25 OpenCode trace showed raw proxy credentials copied into an apply subagent prompt; trace logs are local, but prompts must still avoid replicating secrets across subagent sessions
+
 ## Defaults
 
 - [D1] Delegate to a subagent (`task`) only when the work involves repeated tool-heavy steps that bloat the cache prefix: applying to N≥2 jobs, batch scans hitting ≥3 companies, or any "apply to… / process pipeline / batch evaluate" user phrasing. Single-offer evals, dev work, file edits, `tracker` mode, single-URL checks, and one-shot questions stay inline.
@@ -50,8 +56,8 @@ AI-powered job search pipeline: scans portals, evaluates offers, generates CVs v
 1. Check `cv.md`, `profile.yml`, and `portals.yml`; onboard if any file is missing.
 2. Pick and name the mode from **Routing** [D6]. No match → ask; do not guess.
 3. Read the active mode file [D3]; decide inline vs delegated work [D1].
-4. Prepare Geometra dispatches: cleanup [H3], dedupe [H2], location filter [D5], routing [D2].
-5. Dispatch at most 2 tasks per round [H1]; wait per company [H5].
+4. Prepare Geometra dispatches: cleanup [H3], dedupe [H2], location filter [D5], routing [D2], proxy prompt hygiene [H8].
+5. Dispatch at most 2 tasks per round [H1]; wait for final outcomes, not just task ids [H5b].
 6. Keep multi-job form-filling out of the orchestrator [H4].
 7. Cross-check subagent facts against authoritative files [H7].
 8. Apply score gate [D4].

package/CLAUDE.md

@@ -4,8 +4,8 @@ AI-powered job search pipeline: scans portals, evaluates offers, generates CVs v
 
 ## Hard limits
 
-- [H1] Max 2 parallel `task` dispatches per message. For N jobs, run `ceil(N/2)` sequential rounds of 2. Applies in all modes, for all user phrasings ("urgent", "apply to 10 jobs now").
-  why: higher parallelism blows through free-tier rate limits; each subagent requires post-cleanup and racing more than 2 reliably loses at least one result
+- [H1] Max 2 parallel `task` dispatches per message. For N jobs, run `ceil(N/2)` sequential rounds of 2. A round is not complete until both subagents return a final outcome (`APPLIED`, `APPLY FAILED`, `SKIP`, `Discarded`, or a written TSV path). A `task` tool result that only gives a session id / title is a launch acknowledgement, not completion. Applies in all modes, for all user phrasings ("urgent", "apply to 10 jobs now").
+  why: higher parallelism blows through free-tier rate limits; each subagent requires post-cleanup and racing more than 2 reliably loses at least one result. On 2026-04-25 the orchestrator launched round 2 while round 1 had only returned task ids, leaving four application subagents in flight and losing two provider-fallback recoveries
 
 - [H2] Max 1 application per company+role. Before every `apply` dispatch, grep all four sources for the URL and for `company+role`: `data/pipeline.md`, all `data/applications/*.md` day files, `batch/tracker-additions/*.tsv`, `batch/tracker-additions/merged/*.tsv`. If any source shows APPLIED / Applied, skip the dispatch.
   why: 2026-04 same-day batch collision — when two batches target the same role, `npx job-forge merge` updates the existing day-file row rather than appending, so grepping day files alone misses earlier-batch applies; merged/*.tsv is the only place the breadcrumb remains
@@ -19,12 +19,18 @@ AI-powered job search pipeline: scans portals, evaluates offers, generates CVs v
 - [H5] Re-dispatch the same company only AFTER the previous subagent returns. Never fire the same `task` twice while the first is still in flight.
   why: two in-flight subagents for the same URL race on Geometra sessions and on tracker TSV writes, corrupting state and sometimes double-submitting
 
+- [H5b] Do not use `task` to poll task status. If OpenCode returns a task/session id without a final result, record the id, stop dispatching new rounds, and tell the user the round is still in flight. When the user asks to check later, inspect authoritative files (`batch/tracker-additions/*.tsv`, `batch/tracker-additions/merged/*.tsv`, day files, or `iso-trace`) rather than spawning a "check task status" subagent.
+  why: OpenCode status prompts can be delivered into the target subagent as a new user message; a 2026-04-25 trace caused a subagent to call `task` recursively instead of finishing the application
+
 - [H6] Application outcomes flow through `batch/tracker-additions/*.tsv`, not `data/pipeline.md`. After any multi-apply run, the orchestrator MUST run `npx job-forge merge` then `npx job-forge verify` before ending the session.
   why: `pipeline.md` is the URL inbox (`[ ]` pending → `[x]` processed); `data/applications/YYYY-MM-DD.md` is the outcome log; the TSV pathway is the only safe bridge because `merge` handles column order and duplicate detection
 
 - [H7] Load-bearing facts passed to downstream subagents must originate from a file, not from prior subagent prose. Authoritative sources: `data/pipeline.md`, `data/scan-history.tsv`, `batch/scan-output-*.md`, `reports/{num}-*.md` with `**URL:**` / `**Score:**` headers, `batch/tracker-additions/*.tsv`.
   why: 2026-04-18 scan subagent returned 30 fabricated Greenhouse IDs in prose (plausible-looking, non-existent); orchestrator dispatched 30 downstream subagents that all 404'd. Subagents can hallucinate IDs, scores, and confirmation text — round-trip through a file or don't trust the value
 
+- [H8] Never paste proxy values from `config/profile.yml` into `task` prompts, status text, or summaries. If a proxy is configured, tell the subagent exactly: "Proxy is configured; read `config/profile.yml` and pass its top-level `proxy:` object to every `geometra_connect` call." Do not transcribe `server`, `username`, `password`, or `bypass`, even if you just read them from disk.
+  why: a 2026-04-25 OpenCode trace showed raw proxy credentials copied into an apply subagent prompt; trace logs are local, but prompts must still avoid replicating secrets across subagent sessions
+
 ## Defaults
 
 - [D1] Delegate to a subagent (`task`) only when the work involves repeated tool-heavy steps that bloat the cache prefix: applying to N≥2 jobs, batch scans hitting ≥3 companies, or any "apply to… / process pipeline / batch evaluate" user phrasing. Single-offer evals, dev work, file edits, `tracker` mode, single-URL checks, and one-shot questions stay inline.
@@ -50,8 +56,8 @@ AI-powered job search pipeline: scans portals, evaluates offers, generates CVs v
 1. Check `cv.md`, `profile.yml`, and `portals.yml`; onboard if any file is missing.
 2. Pick and name the mode from **Routing** [D6]. No match → ask; do not guess.
 3. Read the active mode file [D3]; decide inline vs delegated work [D1].
-4. Prepare Geometra dispatches: cleanup [H3], dedupe [H2], location filter [D5], routing [D2].
-5. Dispatch at most 2 tasks per round [H1]; wait per company [H5].
+4. Prepare Geometra dispatches: cleanup [H3], dedupe [H2], location filter [D5], routing [D2], proxy prompt hygiene [H8].
+5. Dispatch at most 2 tasks per round [H1]; wait for final outcomes, not just task ids [H5b].
 6. Keep multi-job form-filling out of the orchestrator [H4].
 7. Cross-check subagent facts against authoritative files [H7].
 8. Apply score gate [D4].

package/bin/create-job-forge.mjs

@@ -110,6 +110,9 @@ const consumerPkg = {
     tokens: 'job-forge tokens',
     'tokens:today': 'job-forge tokens --days 1',
     'tokens:log': 'job-forge tokens --days 1 --append',
+    'trace:list': 'job-forge trace:list',
+    'trace:stats': 'job-forge trace:stats',
+    'trace:show': 'job-forge trace:show',
     // One command to pull the latest harness, companion plugin, and any
     // locally-pinned MCP packages. npm update is a no-op on packages not
     // in package.json, so listing @razroo/gmail-mcp + @geometra/mcp is

package/bin/job-forge.mjs

@@ -17,6 +17,7 @@
  *   pdf            Run generate-pdf.mjs
  *   sync-check     Run cv-sync-check.mjs
  *   tokens         Run scripts/token-usage-report.mjs
+ *   trace:*        Inspect local agent transcripts via iso-trace
  *   sync           Re-run the harness symlink sync (bin/sync.mjs)
  *   help, --help   Show this message
  */
@@ -28,6 +29,7 @@ import { existsSync } from 'fs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const PKG_ROOT = resolve(__dirname, '..');
+const PROJECT_DIR = process.env.JOB_FORGE_PROJECT || process.cwd();
 
 const commands = {
   merge:        'merge-tracker.mjs',
@@ -52,6 +54,12 @@ const commands = {
   'render-report-header': 'scripts/render-report-header.mjs',
 };
 
+const traceAliases = {
+  'trace:list': 'list',
+  'trace:stats': 'stats',
+  'trace:show': 'show',
+};
+
 const [, , cmd, ...rest] = process.argv;
 
 function printHelp() {
@@ -68,6 +76,10 @@ Commands:
   pdf            Generate ATS-optimized CV PDF from cv.md
   sync-check     Lint: verify cv.md and profile.yml are filled in
   tokens         Show opencode token usage and cost by session/day
+  trace          Pass through to iso-trace (e.g. job-forge trace sources)
+  trace:list     List recent local agent sessions (defaults: --since 7d --cwd project)
+  trace:stats    Show trace stats (defaults: --since 7d --cwd project)
+  trace:show ID  Show one trace by id or prefix
   sync           Re-create harness symlinks in the current project
 
 Deterministic helpers (prefer these over LLM-derived values):
@@ -90,6 +102,8 @@ Pass --help after a command to see its own flags, e.g.:
   job-forge merge --help
   job-forge tokens --days 1
   job-forge slugify "Anthropic, PBC"
+  job-forge trace:list --since 24h
+  job-forge trace:show ses_...
 
 Project directory resolves to $JOB_FORGE_PROJECT or cwd.`);
 }
@@ -99,6 +113,21 @@ if (!cmd || cmd === 'help' || cmd === '--help' || cmd === '-h') {
   process.exit(0);
 }
 
+if (cmd === 'trace' || traceAliases[cmd]) {
+  const traceArgs = cmd === 'trace'
+    ? (rest.length === 0 ? ['help'] : rest)
+    : [traceAliases[cmd], ...rest];
+
+  const scriptPath = join(PKG_ROOT, 'scripts/trace.mjs');
+  const result = spawnSync(process.execPath, [scriptPath, ...traceArgs], {
+    stdio: 'inherit',
+    cwd: PROJECT_DIR,
+    env: process.env,
+  });
+
+  process.exit(result.status ?? 1);
+}
+
 const rel = commands[cmd];
 if (!rel) {
   console.error(`Unknown command: ${cmd}\n`);

package/docs/ARCHITECTURE.md

@@ -203,6 +203,7 @@ Scripts maintain data consistency. In a consumer project they're invoked via the
 | `generate-pdf.mjs` | `npx job-forge pdf` | Renders HTML to PDF via Geometra MCP (`geometra_generate_pdf`) or standalone Playwright/Chromium (`npx job-forge pdf <input.html> <output.pdf>`) |
 | `cv-sync-check.mjs` | `npx job-forge sync-check` | Setup lint: `cv.md` + `config/profile.yml`, hardcoded-metric scan on `modes/_shared.md` and `batch/batch-prompt.md`, optional `article-digest.md` freshness |
 | `scripts/token-usage-report.mjs` | `npx job-forge tokens` | Per-session opencode token/cost report from the SQLite DB |
+| `scripts/trace.mjs` | `npx job-forge trace:list` / `trace:stats` / `trace:show` | Local transcript observability via `@razroo/iso-trace`; common commands default to OpenCode sessions for the consumer project |
 | `tracker-lib.mjs` | _(library)_ | Shared helpers for reading/writing day-based tracker files — imported by merge/dedup/verify/normalize |
 | `bin/sync.mjs` | `npx job-forge sync` | Creates the harness symlinks in a consumer project (also runs as `postinstall`) |
 | `bin/create-job-forge.mjs` | `npx create-job-forge <dir>` | Scaffolds a new personal project |

package/docs/CUSTOMIZATION.md

@@ -98,13 +98,23 @@ Some forks use a **single** `data/applications.md` instead. That is fine if you
 
 ## Transcript observability (iso-trace)
 
-To inspect real agent sessions locally (tool mix, redundant fetches, Geometra churn) without uploading transcripts, use Razroo's [`@razroo/iso-trace`](https://github.com/razroo/iso/tree/main/packages/iso-trace).
+To inspect real agent sessions locally (tool mix, redundant fetches, Geometra churn) without uploading transcripts, use the `job-forge trace:*` commands. JobForge depends on Razroo's [`@razroo/iso-trace`](https://github.com/razroo/iso/tree/main/packages/iso-trace), so consumer projects do not need to install it separately.
 
-This harness also ships npm scripts (from the package root): `npm run trace:list`, `npm run trace:stats`, and `npm run trace:show -- <id>` — they wrap `iso-trace` with sensible defaults when the CLI is on `PATH`.
+Common commands default to OpenCode sessions for the current project and use a 7-day window:
+
+```bash
+npx job-forge trace:list
+npx job-forge trace:stats
+npx job-forge trace:show <session-id-or-prefix>
+```
+
+Scaffolded projects also include npm aliases: `npm run trace:list`, `npm run trace:stats`, and `npm run trace:show -- <id>`.
+
+For raw iso-trace commands, use `npx job-forge trace sources`, `npx job-forge trace where`, or any other `iso-trace` subcommand after `trace`.
 
 **Where Claude Code writes JSONL:** `~/.claude/projects/<encoded-cwd>/*.jsonl`.
 
-**CLI (install once per machine):** `npx -y @razroo/iso-trace@latest stats --source "$HOME/.claude/projects/<encoded-dir>/<session>.jsonl"`
+**Direct CLI fallback:** `npx -y @razroo/iso-trace@latest stats --source "$HOME/.claude/projects/<encoded-dir>/<session>.jsonl"`
 
 **Performance:** `iso-trace list --cwd /path/to/repo` walks all of `~/.claude/projects` before filtering; on large machines prefer `stats --source <one.jsonl>` or the library's `discoverSessions({ roots: ["<one encoded project dir>"] })` (see the iso-trace README).
 

package/docs/SETUP.md

@@ -130,6 +130,9 @@ From your project root, these commands maintain the tracker and pipeline checks.
 | Generate ATS-optimized CV PDF | `npx job-forge pdf` | `npm run pdf` |
 | Setup lint (cv.md + profile.yml) | `npx job-forge sync-check` | `npm run sync-check` |
 | Token usage report (from opencode SQLite DB) | `npx job-forge tokens` | `npm run tokens` |
+| List recent OpenCode traces for this project | `npx job-forge trace:list` | `npm run trace:list` |
+| Summarize trace tool/file/token usage | `npx job-forge trace:stats` | `npm run trace:stats` |
+| Show one trace by session id/prefix | `npx job-forge trace:show <id>` | `npm run trace:show -- <id>` |
 | Re-create harness symlinks | `npx job-forge sync` | `npm run sync` |
 | Build optional dashboard TUI (Go on `PATH`) | `(cd node_modules/job-forge/dashboard && go build .)` | `npm run build:dashboard` (harness repo only) |
 

package/iso/agents/general-free.md

@@ -31,6 +31,7 @@ targets:
       geometra_wait_for_resume_parse: true
       gmail_list_messages: true
       gmail_get_message: true
+      task: false
 ---
 
 You are the @general-free subagent. You run on a free-tier model, which means the orchestrator has delegated this task to you **specifically because the work is procedural**: deterministic steps, scripted outputs, no nuanced writing required.
@@ -82,6 +83,7 @@ Previous subagents sometimes abort mid-flow (ran out of context, hit a timeout,
 - Write cover letter prose, "Why X?" answers, or Section G draft answers. Those go to `@general-paid`.
 - Perform offer evaluation narratives (Blocks A-F). Those go to `@general-paid`.
 - Override harness rules or invent fields. Follow the mode files exactly.
+- Spawn or check other tasks. If you receive "check if task ses_..." and it refers to this session, report your current status from your own work. Never call `task` recursively.
 
 ## Apply This Working Style
 

package/iso/agents/general-paid.md

@@ -24,8 +24,18 @@ targets:
       - openrouter/google/gemma-4-31b-it:free
       - openrouter/meta-llama/llama-3.3-70b-instruct:free
     tools:
-      geometra_*: false
-      gmail_*: false
+      geometra_connect: true
+      geometra_page_model: true
+      geometra_form_schema: true
+      geometra_run_actions: true
+      geometra_fill_otp: true
+      geometra_upload_files: true
+      geometra_list_sessions: true
+      geometra_disconnect: true
+      geometra_wait_for_resume_parse: true
+      gmail_list_messages: true
+      gmail_get_message: true
+      task: false
 ---
 
 You are the @general-paid subagent. The orchestrator delegated this task to you because it requires quality writing or judgment — the kind of work `@general-free` isn't well-suited for.
@@ -42,12 +52,14 @@ were given.
 - Compose STAR+R interview stories and the story bank (`modes/offer.md` Block F).
 - Draft LinkedIn outreach messages (`modes/contact.md`).
 - Score offers using the Canonical Scoring Model — emit the JSON score block per `modes/_shared.md`, then the narrative report.
+- Drive a single high-stakes application form only when the orchestrator explicitly dispatches you in `apply` mode. In that case, follow `modes/apply.md` exactly and use the same Geometra/Gmail flow as `@general-free`.
 
 ## Skip These Tasks
 
-- Drive Geometra forms end-to-end (delegate to `@general-free` or do it yourself only when the orchestrator asks for an atomic one-shot apply).
+- Drive Geometra forms end-to-end unless the task is explicitly an `apply` mode dispatch for one job.
 - Manage trackers, run scripts, or do mechanical TSV/dedup work. Those go to `@general-free`.
 - Duplicate work. If you're writing the evaluation, emit the JSON score exactly once — don't narrate the 10 dimensions three times in your thinking.
+- Spawn or check other tasks. If you receive "check if task ses_..." and it refers to this session, report your current status from your own work. Never call `task` recursively.
 
 ## Apply This Working Style
 

package/iso/commands/job-forge.md

@@ -155,10 +155,17 @@ Step 3  — Pre-flight cleanup (once, before the loop)
 Step 4  — Loop in rounds of 2 (Hard Limit #1)
   for round in ceil(len(candidates) / 2):
     pair = candidates[round*2 : round*2 + 2]
+    # If proxy is configured, do not paste proxy values into prompts.
+    # Say: "Proxy is configured; read config/profile.yml and pass its
+    # top-level proxy object to every geometra_connect call."
     # Dispatch 1 or 2 task() calls in ONE message (never 3+)
     task(subagent_type=<tier per AGENTS.md routing>, prompt=<apply prompt for pair[0]>)
     task(subagent_type=<tier>, prompt=<apply prompt for pair[1]>)  # only if pair has 2
-    # WAIT for both subagents to return before proceeding
+    # WAIT for both subagents to return final APPLIED / APPLY FAILED / SKIP /
+    # Discarded outcomes or TSV paths before proceeding.
+    # A returned task/session id is only a launch receipt, not completion.
+    # Do not create a "check task status" task; inspect tracker files or
+    # iso-trace if the user asks for status later.
     # Read their return values, log outcomes
 
 Step 5  — Between rounds: clean sessions again

package/iso/instructions.md

@@ -4,8 +4,8 @@ AI-powered job search pipeline: scans portals, evaluates offers, generates CVs v
 
 ## Hard limits
 
-- [H1] Max 2 parallel `task` dispatches per message. For N jobs, run `ceil(N/2)` sequential rounds of 2. Applies in all modes, for all user phrasings ("urgent", "apply to 10 jobs now").
-  why: higher parallelism blows through free-tier rate limits; each subagent requires post-cleanup and racing more than 2 reliably loses at least one result
+- [H1] Max 2 parallel `task` dispatches per message. For N jobs, run `ceil(N/2)` sequential rounds of 2. A round is not complete until both subagents return a final outcome (`APPLIED`, `APPLY FAILED`, `SKIP`, `Discarded`, or a written TSV path). A `task` tool result that only gives a session id / title is a launch acknowledgement, not completion. Applies in all modes, for all user phrasings ("urgent", "apply to 10 jobs now").
+  why: higher parallelism blows through free-tier rate limits; each subagent requires post-cleanup and racing more than 2 reliably loses at least one result. On 2026-04-25 the orchestrator launched round 2 while round 1 had only returned task ids, leaving four application subagents in flight and losing two provider-fallback recoveries
 
 - [H2] Max 1 application per company+role. Before every `apply` dispatch, grep all four sources for the URL and for `company+role`: `data/pipeline.md`, all `data/applications/*.md` day files, `batch/tracker-additions/*.tsv`, `batch/tracker-additions/merged/*.tsv`. If any source shows APPLIED / Applied, skip the dispatch.
   why: 2026-04 same-day batch collision — when two batches target the same role, `npx job-forge merge` updates the existing day-file row rather than appending, so grepping day files alone misses earlier-batch applies; merged/*.tsv is the only place the breadcrumb remains
@@ -19,12 +19,18 @@ AI-powered job search pipeline: scans portals, evaluates offers, generates CVs v
 - [H5] Re-dispatch the same company only AFTER the previous subagent returns. Never fire the same `task` twice while the first is still in flight.
   why: two in-flight subagents for the same URL race on Geometra sessions and on tracker TSV writes, corrupting state and sometimes double-submitting
 
+- [H5b] Do not use `task` to poll task status. If OpenCode returns a task/session id without a final result, record the id, stop dispatching new rounds, and tell the user the round is still in flight. When the user asks to check later, inspect authoritative files (`batch/tracker-additions/*.tsv`, `batch/tracker-additions/merged/*.tsv`, day files, or `iso-trace`) rather than spawning a "check task status" subagent.
+  why: OpenCode status prompts can be delivered into the target subagent as a new user message; a 2026-04-25 trace caused a subagent to call `task` recursively instead of finishing the application
+
 - [H6] Application outcomes flow through `batch/tracker-additions/*.tsv`, not `data/pipeline.md`. After any multi-apply run, the orchestrator MUST run `npx job-forge merge` then `npx job-forge verify` before ending the session.
   why: `pipeline.md` is the URL inbox (`[ ]` pending → `[x]` processed); `data/applications/YYYY-MM-DD.md` is the outcome log; the TSV pathway is the only safe bridge because `merge` handles column order and duplicate detection
 
 - [H7] Load-bearing facts passed to downstream subagents must originate from a file, not from prior subagent prose. Authoritative sources: `data/pipeline.md`, `data/scan-history.tsv`, `batch/scan-output-*.md`, `reports/{num}-*.md` with `**URL:**` / `**Score:**` headers, `batch/tracker-additions/*.tsv`.
   why: 2026-04-18 scan subagent returned 30 fabricated Greenhouse IDs in prose (plausible-looking, non-existent); orchestrator dispatched 30 downstream subagents that all 404'd. Subagents can hallucinate IDs, scores, and confirmation text — round-trip through a file or don't trust the value
 
+- [H8] Never paste proxy values from `config/profile.yml` into `task` prompts, status text, or summaries. If a proxy is configured, tell the subagent exactly: "Proxy is configured; read `config/profile.yml` and pass its top-level `proxy:` object to every `geometra_connect` call." Do not transcribe `server`, `username`, `password`, or `bypass`, even if you just read them from disk.
+  why: a 2026-04-25 OpenCode trace showed raw proxy credentials copied into an apply subagent prompt; trace logs are local, but prompts must still avoid replicating secrets across subagent sessions
+
 ## Defaults
 
 - [D1] Delegate to a subagent (`task`) only when the work involves repeated tool-heavy steps that bloat the cache prefix: applying to N≥2 jobs, batch scans hitting ≥3 companies, or any "apply to… / process pipeline / batch evaluate" user phrasing. Single-offer evals, dev work, file edits, `tracker` mode, single-URL checks, and one-shot questions stay inline.
@@ -50,8 +56,8 @@ AI-powered job search pipeline: scans portals, evaluates offers, generates CVs v
 1. Check `cv.md`, `profile.yml`, and `portals.yml`; onboard if any file is missing.
 2. Pick and name the mode from **Routing** [D6]. No match → ask; do not guess.
 3. Read the active mode file [D3]; decide inline vs delegated work [D1].
-4. Prepare Geometra dispatches: cleanup [H3], dedupe [H2], location filter [D5], routing [D2].
-5. Dispatch at most 2 tasks per round [H1]; wait per company [H5].
+4. Prepare Geometra dispatches: cleanup [H3], dedupe [H2], location filter [D5], routing [D2], proxy prompt hygiene [H8].
+5. Dispatch at most 2 tasks per round [H1]; wait for final outcomes, not just task ids [H5b].
 6. Keep multi-job form-filling out of the orchestrator [H4].
 7. Cross-check subagent facts against authoritative files [H7].
 8. Apply score gate [D4].

package/modes/apply.md

@@ -16,8 +16,8 @@ Live application assistant. Reads the active application form in Chrome (via Geo
 - [H4] Before dispatching the first subagent in a multi-job run, the orchestrator MUST call `geometra_list_sessions` then `geometra_disconnect({closeBrowser: true})`. Every dispatch-round, no exceptions.
   why: prior aborted subagents leave Chromium sessions stuck in the pool; next `geometra_connect` fails with "Not connected" (see root `[H3]`)
 
-- [H5] Max 2 parallel `task` dispatches per round. For N jobs, run `ceil(N/2)` sequential rounds of 2. Never emit 3+ dispatches in a single message.
-  why: free-tier rate limits + subagent post-cleanup cost; racing more than 2 reliably loses at least one result (see root `[H1]`)
+- [H5] Max 2 parallel `task` dispatches per round. For N jobs, run `ceil(N/2)` sequential rounds of 2. Never emit 3+ dispatches in a single message. Do not start the next round until both current-round subagents return final outcomes (`APPLIED`, `APPLY FAILED`, `SKIP`, `Discarded`, or a written TSV path); task/session ids are only launch receipts.
+  why: free-tier rate limits + subagent post-cleanup cost; racing more than 2 reliably loses at least one result (see root `[H1]`). A 2026-04-25 OpenCode trace launched round 2 while round 1 was still running, then lost two fallback recoveries
 
 ## Defaults
 
@@ -42,7 +42,7 @@ Live application assistant. Reads the active application form in Chrome (via Geo
 - [D6] Use `fieldLabel` over `fieldId` everywhere it works.
   why: labels are stable across DOM refreshes; IDs are regenerated
 
-- [D7] If the orchestrator's task prompt includes a `proxy` object (sourced from `config/profile.yml`), pass it verbatim into every `geometra_connect` call — including Call 3 of the recovery sequence. If absent, run without one; never invent a proxy URL.
+- [D7] If the orchestrator says a proxy is configured, read the top-level `proxy:` block from `config/profile.yml` and pass that object into every `geometra_connect` call — including Call 3 of the recovery sequence. If the task prompt includes a legacy inline `proxy` object, pass it through, but do not echo credentials in status text. If absent, run without one; never invent a proxy URL.
   why: class-B Ashby / Cloudflare-fronted portals need a residential outbound IP; the fix is wired in Geometra MCP v1.59.0 but the orchestrator owns the config pipe. See "BYO Residential Proxy" in modes/reference-portals.md.
 
 - [D8] Upgrade application routing to `@general-paid` when the offer score is ≥ 4.0/5, the user flags "top-tier", "dream job", or "high-stakes", or the candidate is late-stage/post-screen.
@@ -115,6 +115,13 @@ Sections below are the detailed runbooks, decision tables, and portal-specific e
 
 **DO NOT dispatch 3+ `task` calls in one message.** Two is the absolute ceiling. This is non-negotiable, even when the user asks for "apply to 10 jobs" — that becomes 5 rounds of 2, not one message with 10 dispatches.
 
+**A task/session id is not a result.** If OpenCode gives you a `ses_...`
+id or title after dispatch, do not treat that as the subagent return.
+Do not create another `task` to check it. Stop the round, report the
+in-flight ids, and resume only after a real outcome is visible in the
+subagent return or in an authoritative file (`batch/tracker-additions/`,
+`batch/tracker-additions/merged/`, or the day file).
+
 For a single application interactively, carry on in the current session — the rule targets multi-job loops.
 
 ## Apply Preflight — Location Filter (orchestrator runs before dispatch)
@@ -176,7 +183,8 @@ Step 4  — For round in ceil(N/2):
             # ONE message, 1 or 2 task() calls. Never 3.
             task(apply to pair[0])
             task(apply to pair[1])  # only if pair has 2
-            # WAIT for both returns. Do not proceed until both done.
+            # WAIT for both final outcomes. A session id is not completion.
+            # Do not dispatch round N+1 while round N is still in flight.
 Step 5  — Between rounds: geometra_list_sessions() + geometra_disconnect({closeBrowser: true})
 Step 6  — Reconcile outcomes (Hard Limit #6):
             bash: npx job-forge merge       # TSVs → day file

package/modes/reference-geometra.md

@@ -188,7 +188,8 @@ Step 2:  geometra_disconnect({ closeBrowser: true })
 Step 3:  geometra_connect({ pageUrl: "<the URL the orchestrator gave you>", isolated: true, headless: true, slowMo: 350 })
 ```
 
-**If the orchestrator passed a `proxy` object in the task prompt** (sourced from `config/profile.yml`), add it to Step 3:
+**If the orchestrator says proxy is configured,** read the top-level
+`proxy:` block from `config/profile.yml` and add it to Step 3:
 
 ```
 Step 3:  geometra_connect({
@@ -197,7 +198,7 @@ Step 3:  geometra_connect({
          })
 ```
 
-Pass the proxy object through unchanged. Do NOT paraphrase or drop fields — `username`/`password`/`bypass` are optional, so only include what the orchestrator gave you. See the "BYO Residential Proxy" reference section for the why.
+Pass the proxy object through unchanged. Do NOT paraphrase or drop fields — `username`/`password`/`bypass` are optional, so only include what exists in `config/profile.yml`. Do not echo proxy credentials in status text. See the "BYO Residential Proxy" reference section for the why.
 
 **DO NOT** skip Step 1 or Step 2. **DO NOT** think about whether it's needed. **DO NOT** look at `geometra_list_sessions` output and reason about it — just always call `geometra_disconnect({ closeBrowser: true })` next. The disconnect is a no-op if the pool is empty, and a poison-cure if it isn't.
 

package/modes/reference-portals.md

@@ -75,16 +75,17 @@ See `config/profile.example.yml` for the commented-out template.
 
 **Orchestrator responsibilities:**
 
-1. On session start, read `config/profile.yml` once. If a `proxy:` block is present, capture it as the `PROXY_CONFIG` for the session.
-2. When dispatching any subagent whose work involves a `geometra_connect` call, include `PROXY_CONFIG` verbatim in the task prompt. Example dispatch prompt line: "Pass `proxy: { server: ..., username: ..., password: ..., bypass: ... }` to every `geometra_connect` call you make."
-3. When the orchestrator itself opens a Chromium session (single-application interactive flow), include the same `proxy` object in its own `geometra_connect` call.
+1. On session start, read `config/profile.yml` once. If a `proxy:` block is present, remember that a proxy is configured, but do not paste username/password values into task prompts or user-visible status.
+2. When dispatching any subagent whose work involves a `geometra_connect` call, tell it to read `config/profile.yml` and pass the top-level `proxy:` block to every `geometra_connect` call. Example dispatch prompt line: "Proxy is configured; read `config/profile.yml` and pass its top-level `proxy:` object to every `geometra_connect` call."
+3. When the orchestrator itself opens a Chromium session (single-application interactive flow), include the same `proxy` object from `config/profile.yml` in its own `geometra_connect` call.
 4. If `proxy:` is absent from `profile.yml`, skip the param entirely. Do NOT invent a proxy URL or leave a stale placeholder.
 
 **Subagent responsibilities:**
 
-1. If the task prompt includes a `proxy` object, pass it through to `geometra_connect` and any `geometra_prepare_browser` calls unchanged.
-2. If the task prompt does NOT include a proxy object, run without one.
-3. Never second-guess the proxy field — if the orchestrator sourced it from `profile.yml`, it's authoritative.
+1. If the task prompt says proxy is configured, read `config/profile.yml` and pass the top-level `proxy:` object through to `geometra_connect` and any `geometra_prepare_browser` calls unchanged.
+2. If the task prompt includes a legacy inline `proxy` object, pass it through unchanged, but never print the credentials back in status text.
+3. If the task prompt does NOT mention a proxy and `config/profile.yml` has no `proxy:` block, run without one.
+4. Never second-guess the proxy field — if it comes from `profile.yml`, it's authoritative.
 
 ### When proxy use is load-bearing
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "job-forge",
-  "version": "2.14.8",
+  "version": "2.14.10",
   "description": "AI-powered job search pipeline built on opencode",
   "type": "module",
   "bin": {
@@ -18,9 +18,9 @@
     "tokens": "node scripts/token-usage-report.mjs",
     "tokens:today": "node scripts/token-usage-report.mjs --days 1",
     "tokens:log": "node scripts/token-usage-report.mjs --days 1 --append",
-    "trace:list": "iso-trace list --since 7d --cwd .",
-    "trace:stats": "iso-trace stats --since 7d --cwd .",
-    "trace:show": "iso-trace show",
+    "trace:list": "node bin/job-forge.mjs trace:list",
+    "trace:stats": "node bin/job-forge.mjs trace:stats",
+    "trace:show": "node bin/job-forge.mjs trace:show",
     "plan": "iso plan .",
     "lint:agentmd": "agentmd lint iso/instructions.md",
     "lint:modes": "isolint lint modes/",
@@ -85,6 +85,7 @@
     "node": ">=18"
   },
   "dependencies": {
+    "@razroo/iso-trace": "^0.4.0",
     "playwright": "^1.58.1"
   },
   "devDependencies": {
@@ -93,7 +94,6 @@
     "@razroo/iso-eval": "^0.4.0",
     "@razroo/iso-harness": "^0.6.1",
     "@razroo/iso-route": "^0.5.3",
-    "@razroo/iso-trace": "^0.4.0",
     "@razroo/opencode-model-fallback": "^0.3.1"
   }
 }

package/scripts/trace.mjs

@@ -0,0 +1,469 @@
+#!/usr/bin/env node
+
+import { spawnSync } from 'child_process';
+import { existsSync } from 'fs';
+import { createRequire } from 'module';
+import { dirname, join, resolve } from 'path';
+import { fileURLToPath } from 'url';
+import {
+  defaultOpenCodeDbPath,
+  findSessionById,
+  openCodeSessionLocator,
+  parseSinceCutoff,
+} from '@razroo/iso-trace';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const require = createRequire(import.meta.url);
+const PROJECT_DIR = process.env.JOB_FORGE_PROJECT || process.cwd();
+
+const USAGE = `job-forge trace — local OpenCode transcript observability
+
+Usage:
+  job-forge trace:list [--since 7d] [--cwd <dir>] [--json]
+  job-forge trace:stats [<id-or-prefix>...] [--since 7d] [--cwd <dir>] [--json]
+  job-forge trace:show <id-or-prefix> [--events <kinds>] [--grep <regex>]
+  job-forge trace <iso-trace args...>
+
+Common aliases default to OpenCode sessions for the current JobForge project.
+Use "job-forge trace sources" or "job-forge trace where" for raw iso-trace passthrough.`;
+
+const [cmd = 'help', ...args] = process.argv.slice(2);
+
+function parseFilters(rawArgs) {
+  const opts = { since: '7d', cwd: PROJECT_DIR, json: false };
+  const positional = [];
+
+  for (let i = 0; i < rawArgs.length; i++) {
+    const arg = rawArgs[i];
+    if (arg === '--since') {
+      opts.since = rawArgs[++i];
+    } else if (arg.startsWith('--since=')) {
+      opts.since = arg.slice('--since='.length);
+    } else if (arg === '--cwd') {
+      opts.cwd = rawArgs[++i];
+    } else if (arg.startsWith('--cwd=')) {
+      opts.cwd = arg.slice('--cwd='.length);
+    } else if (arg === '--json') {
+      opts.json = true;
+    } else if (arg === '--help' || arg === '-h') {
+      opts.help = true;
+    } else if (arg.startsWith('--')) {
+      opts.error = `unknown flag "${arg}"`;
+    } else {
+      positional.push(arg);
+    }
+  }
+
+  opts.cwd = resolve(opts.cwd || PROJECT_DIR);
+  return { opts, positional };
+}
+
+function parseShowArgs(rawArgs) {
+  const opts = {};
+  const positional = [];
+
+  for (let i = 0; i < rawArgs.length; i++) {
+    const arg = rawArgs[i];
+    if (arg === '--events') {
+      const raw = rawArgs[++i] || '';
+      opts.events = new Set(raw.split(',').map((s) => s.trim()).filter(Boolean));
+    } else if (arg.startsWith('--events=')) {
+      const raw = arg.slice('--events='.length);
+      opts.events = new Set(raw.split(',').map((s) => s.trim()).filter(Boolean));
+    } else if (arg === '--grep') {
+      opts.grep = compileRegex(rawArgs[++i], 'trace:show');
+    } else if (arg.startsWith('--grep=')) {
+      opts.grep = compileRegex(arg.slice('--grep='.length), 'trace:show');
+    } else if (arg === '--help' || arg === '-h') {
+      opts.help = true;
+    } else if (arg.startsWith('--')) {
+      opts.error = `unknown flag "${arg}"`;
+    } else {
+      positional.push(arg);
+    }
+  }
+
+  return { opts, positional };
+}
+
+function compileRegex(pattern, context) {
+  try {
+    return new RegExp(pattern || '', 'i');
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return new Error(`${context}: invalid --grep regex: ${message}`);
+  }
+}
+
+async function discoverOpenCodeRefs(opts) {
+  const dbPath = defaultOpenCodeDbPath();
+  if (!existsSync(dbPath)) return [];
+
+  const where = [
+    's.time_archived is null',
+    `s.directory = ${sqlString(resolve(opts.cwd || PROJECT_DIR))}`,
+  ];
+  const sinceMs = parseSinceCutoff(opts.since);
+  if (sinceMs !== undefined) {
+    where.push(`s.time_created >= ${Number(sinceMs)}`);
+  }
+
+  const rows = queryOpenCodeDb(dbPath, [
+    'select',
+    '  s.id,',
+    '  s.directory,',
+    '  s.time_created,',
+    '  s.time_updated,',
+    '  (select count(*) from message m where m.session_id = s.id) as turn_count,',
+    '  (',
+    '    (select coalesce(sum(length(data)), 0) from message m where m.session_id = s.id) +',
+    '    (select coalesce(sum(length(data)), 0) from part p where p.session_id = s.id)',
+    '  ) as size_bytes',
+    'from session s',
+    `where ${where.join(' and ')}`,
+    'order by s.time_updated desc',
+  ].join(' '));
+
+  return rows.map((row) => ({
+    id: row.id,
+    source: {
+      harness: 'opencode',
+      format: 'opencode/sqlite-v1',
+      path: openCodeSessionLocator(row.id, dbPath),
+    },
+    cwd: row.directory,
+    startedAt: msToIso(row.time_created),
+    endedAt: msToIso(row.time_updated),
+    turnCount: row.turn_count ?? 0,
+    sizeBytes: row.size_bytes ?? 0,
+  }));
+}
+
+function queryOpenCodeDb(dbPath, sql) {
+  const result = spawnSync('sqlite3', ['-json', dbPath, sql], {
+    encoding: 'utf8',
+    maxBuffer: 16 * 1024 * 1024,
+  });
+  if ((result.status ?? 0) !== 0) {
+    const detail = result.stderr?.trim() || result.stdout?.trim() || `exit ${result.status ?? 1}`;
+    throw new Error(`job-forge trace: sqlite3 query failed: ${detail}`);
+  }
+  return JSON.parse(result.stdout || '[]');
+}
+
+function sqlString(value) {
+  return `'${String(value).replaceAll("'", "''")}'`;
+}
+
+function msToIso(ms) {
+  return new Date(Number(ms)).toISOString();
+}
+
+function sizeLabel(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
+  return `${(bytes / 1024 / 1024).toFixed(1)} MB`;
+}
+
+function shorten(value, max) {
+  const text = String(value ?? '');
+  if (text.length <= max) return text;
+  return `${text.slice(0, max - 1)}...`;
+}
+
+function pad(value, width) {
+  const text = String(value ?? '');
+  return text.length >= width ? text : text + ' '.repeat(width - text.length);
+}
+
+function printSessionTable(refs) {
+  const rows = refs.map((ref) => [
+    ref.id,
+    ref.startedAt.replace('T', ' ').replace(/\.\d+Z$/, 'Z'),
+    shorten(ref.cwd, 42),
+    String(ref.turnCount),
+    sizeLabel(ref.sizeBytes),
+  ]);
+  const header = ['id', 'started', 'cwd', 'turns', 'size'];
+  const widths = header.map((h, i) => Math.max(h.length, ...rows.map((row) => row[i].length)));
+
+  console.log(header.map((h, i) => pad(h, widths[i])).join('  '));
+  console.log(widths.map((w) => '-'.repeat(w)).join('  '));
+  for (const row of rows) {
+    console.log(row.map((cell, i) => pad(cell, widths[i])).join('  '));
+  }
+}
+
+function printStats(result) {
+  console.log(`sessions:  ${result.sessions}`);
+  console.log(`turns:     ${result.turns}`);
+  console.log(`duration:  ${Math.round(result.durationMs / 1000)}s`);
+  console.log(`tokens:    input=${result.tokens.input} output=${result.tokens.output} cache_read=${result.tokens.cacheRead} cache_created=${result.tokens.cacheCreated}`);
+
+  console.log('\ntool calls:');
+  for (const [name, count] of Object.entries(result.toolCalls).sort((a, b) => b[1] - a[1])) {
+    console.log(`  ${pad(name, 28)} ${count}`);
+  }
+
+  console.log('\nfile ops:');
+  for (const [name, count] of Object.entries(result.fileOps).sort((a, b) => b[1] - a[1])) {
+    console.log(`  ${pad(name, 8)} ${count}`);
+  }
+}
+
+function computeOpenCodeStats(refs) {
+  const result = {
+    sessions: refs.length,
+    turns: 0,
+    durationMs: 0,
+    tokens: { input: 0, output: 0, cacheRead: 0, cacheCreated: 0 },
+    toolCalls: {},
+    fileOps: {},
+  };
+
+  for (const ref of refs) {
+    const rows = loadOpenCodeRows(ref.id);
+    result.turns += rows.messages.length;
+    result.durationMs += Math.max(0, Date.parse(ref.endedAt || ref.startedAt) - Date.parse(ref.startedAt));
+
+    for (const row of rows.messages) {
+      const data = parseJson(row.data);
+      const tokens = data.tokens;
+      if (!tokens || typeof tokens !== 'object') continue;
+      result.tokens.input += Number(tokens.input || 0);
+      result.tokens.output += Number(tokens.output || 0);
+      result.tokens.cacheRead += Number(tokens.cache?.read || 0);
+      result.tokens.cacheCreated += Number(tokens.cache?.write || 0);
+    }
+
+    for (const row of rows.parts) {
+      const data = parseJson(row.data);
+      if (data.type !== 'tool') continue;
+      const toolName = data.tool || 'unknown';
+      result.toolCalls[toolName] = (result.toolCalls[toolName] || 0) + 1;
+      const op = fileOpForTool(toolName);
+      if (op) result.fileOps[op] = (result.fileOps[op] || 0) + 1;
+    }
+  }
+
+  return result;
+}
+
+function printOpenCodeSession(ref, opts) {
+  const rows = loadOpenCodeRows(ref.id);
+  console.log(`id:        ${ref.id}`);
+  console.log(`source:    ${ref.source.harness} (${ref.source.format})`);
+  console.log(`path:      ${ref.source.path}`);
+  console.log(`cwd:       ${ref.cwd}`);
+  console.log(`started:   ${ref.startedAt}`);
+  if (ref.endedAt) console.log(`ended:     ${ref.endedAt}`);
+  console.log(`turns:     ${rows.messages.length}`);
+  console.log('');
+
+  const events = openCodeEvents(rows);
+  for (const event of events) {
+    if (opts.events && !opts.events.has(event.kind)) continue;
+    const line = formatOpenCodeEvent(event);
+    if (opts.grep && !opts.grep.test(line)) continue;
+    console.log(line);
+  }
+}
+
+function loadOpenCodeRows(sessionId) {
+  const dbPath = defaultOpenCodeDbPath();
+  const id = sqlString(sessionId);
+  return {
+    messages: queryOpenCodeDb(dbPath, `select id, time_created, data from message where session_id = ${id} order by time_created, id`),
+    parts: queryOpenCodeDb(dbPath, `select id, message_id, time_created, data from part where session_id = ${id} order by time_created, id`),
+  };
+}
+
+function openCodeEvents(rows) {
+  const events = [];
+
+  for (const row of rows.messages) {
+    const data = parseJson(row.data);
+    const at = msToIso(row.time_created);
+    const model = data.modelID && data.providerID ? `${data.providerID}/${data.modelID}` : undefined;
+    const error = data.error?.data?.message || data.error?.message;
+    events.push({
+      kind: error ? 'error' : 'turn',
+      at,
+      text: error
+        ? `${data.role || 'assistant'} ${data.agent || ''} ${model || ''}: ${error}`
+        : `${data.role || 'unknown'} ${data.agent || ''} ${model || ''} finish=${data.finish || 'unknown'}`,
+    });
+    if (data.tokens) {
+      events.push({
+        kind: 'token_usage',
+        at,
+        text: `input=${data.tokens.input || 0} output=${data.tokens.output || 0} cache_read=${data.tokens.cache?.read || 0} cache_created=${data.tokens.cache?.write || 0}${model ? ` model=${model}` : ''}`,
+      });
+    }
+  }
+
+  for (const row of rows.parts) {
+    const data = parseJson(row.data);
+    const at = msToIso(row.time_created);
+    if (data.type === 'text') {
+      events.push({ kind: 'message', at, text: data.text || '' });
+    } else if (data.type === 'reasoning') {
+      events.push({ kind: 'reasoning', at, text: data.text || '' });
+    } else if (data.type === 'tool') {
+      const status = data.state?.status ? ` status=${data.state.status}` : '';
+      const input = data.state?.input ? ` ${JSON.stringify(data.state.input)}` : '';
+      const output = data.state?.output ? ` => ${data.state.output}` : '';
+      events.push({ kind: 'tool_call', at, text: `${data.tool || 'unknown'}${status}${input}${output}` });
+      const op = fileOpForTool(data.tool);
+      if (op) events.push({ kind: 'file_op', at, text: `${op} ${filePathFromTool(data) || ''}`.trim() });
+    } else if (data.__parseError) {
+      events.push({ kind: 'error', at, text: `unparseable part JSON: ${data.__parseError}` });
+    } else {
+      events.push({ kind: data.type || 'part', at, text: JSON.stringify(data) });
+    }
+  }
+
+  return events.sort((a, b) => a.at.localeCompare(b.at));
+}
+
+function formatOpenCodeEvent(event) {
+  return `${event.at} ${event.kind}: ${oneLine(event.text, 360)}`;
+}
+
+function parseJson(raw) {
+  try {
+    return JSON.parse(raw || '{}');
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return { __parseError: message, __raw: raw };
+  }
+}
+
+function fileOpForTool(toolName) {
+  if (toolName === 'read') return 'read';
+  if (toolName === 'write') return 'write';
+  if (toolName === 'edit') return 'edit';
+  if (toolName === 'glob') return 'list';
+  if (toolName === 'grep') return 'search';
+  return undefined;
+}
+
+function filePathFromTool(part) {
+  const input = part.state?.input;
+  if (!input || typeof input !== 'object') return undefined;
+  return input.filePath || input.path || input.pattern;
+}
+
+function oneLine(value, max) {
+  return shorten(String(value ?? '').replace(/\s+/g, ' ').trim(), max);
+}
+
+function resolveIsoTraceCli() {
+  const pkgJsonPath = require.resolve('@razroo/iso-trace/package.json');
+  return join(dirname(pkgJsonPath), 'dist/cli.js');
+}
+
+function passthroughIsoTrace(rawArgs) {
+  const cliPath = resolveIsoTraceCli();
+  const result = spawnSync(process.execPath, [cliPath, ...rawArgs], {
+    stdio: 'inherit',
+    cwd: PROJECT_DIR,
+    env: process.env,
+  });
+  return result.status ?? 1;
+}
+
+async function main() {
+  if (cmd === 'help' || cmd === '--help' || cmd === '-h') {
+    console.log(USAGE);
+    return 0;
+  }
+
+  if (cmd === 'list') {
+    const { opts } = parseFilters(args);
+    if (opts.help) {
+      console.log(USAGE);
+      return 0;
+    }
+    if (opts.error) {
+      console.error(`job-forge trace:list: ${opts.error}`);
+      return 2;
+    }
+    const refs = await discoverOpenCodeRefs(opts);
+    if (opts.json) {
+      console.log(JSON.stringify(refs, null, 2));
+      return 0;
+    }
+    if (refs.length === 0) {
+      console.error('job-forge trace:list: no OpenCode sessions found for this project');
+      return 2;
+    }
+    printSessionTable(refs);
+    return 0;
+  }
+
+  if (cmd === 'stats') {
+    const { opts, positional } = parseFilters(args);
+    if (opts.help) {
+      console.log(USAGE);
+      return 0;
+    }
+    if (opts.error) {
+      console.error(`job-forge trace:stats: ${opts.error}`);
+      return 2;
+    }
+    const refs = await discoverOpenCodeRefs(opts);
+    const selected = positional.length === 0
+      ? refs
+      : positional.map((id) => {
+          const ref = findSessionById(refs, id);
+          if (!ref) throw new Error(`job-forge trace:stats: no OpenCode session matches "${id}"`);
+          return ref;
+        });
+    const result = computeOpenCodeStats(selected);
+    if (opts.json) {
+      console.log(JSON.stringify(result, null, 2));
+    } else {
+      printStats(result);
+    }
+    return 0;
+  }
+
+  if (cmd === 'show') {
+    const { opts, positional } = parseShowArgs(args);
+    if (opts.help) {
+      console.log(USAGE);
+      return 0;
+    }
+    if (opts.error) {
+      console.error(`job-forge trace:show: ${opts.error}`);
+      return 2;
+    }
+    if (opts.grep instanceof Error) {
+      console.error(opts.grep.message);
+      return 2;
+    }
+    if (positional.length === 0) {
+      console.error('job-forge trace:show: missing <id-or-prefix>');
+      return 2;
+    }
+    const refs = await discoverOpenCodeRefs({ cwd: PROJECT_DIR, since: undefined });
+    const ref = findSessionById(refs, positional[0]);
+    if (!ref) {
+      console.error(`job-forge trace:show: no OpenCode session matches "${positional[0]}"`);
+      return 2;
+    }
+    printOpenCodeSession(ref, opts);
+    return 0;
+  }
+
+  return passthroughIsoTrace([cmd, ...args]);
+}
+
+main()
+  .then((code) => process.exit(code))
+  .catch((error) => {
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(message);
+    process.exit(1);
+  });