jobhunt-kit 0.3.0 → 0.5.0

package/plugins/jobhunt-kit/scripts/files.mjs

@@ -0,0 +1,69 @@
+import { randomUUID, createHash } from 'node:crypto';
+import { existsSync, lstatSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { dirname, isAbsolute, relative, resolve, sep } from 'node:path';
+
+export const MAX_JSON_BYTES = 2 * 1024 * 1024;
+export const MAX_RESUME_BYTES = 20 * 1024 * 1024;
+export const sha256 = bytes => createHash('sha256').update(bytes).digest('hex');
+
+export function inside(base, candidate) {
+  const delta = relative(resolve(base), resolve(candidate));
+  return delta === '' || (!isAbsolute(delta) && delta !== '..' && !delta.startsWith(`..${sep}`));
+}
+
+export function assertNoSymlink(path, stop = dirname(resolve(path))) {
+  let current = resolve(path);
+  const boundary = resolve(stop);
+  while (inside(boundary, current)) {
+    if (existsSync(current) && lstatSync(current).isSymbolicLink()) throw new Error(`Symbolic links are not allowed for local data: ${current}`);
+    if (current === boundary) return;
+    const parent = dirname(current);
+    if (parent === current) break;
+    current = parent;
+  }
+  throw new Error(`Path escapes the expected data directory: ${path}`);
+}
+
+export function localPath(base, path) {
+  if (typeof path !== 'string' || !path.trim() || isAbsolute(path)) throw new Error('Expected a relative path inside the local data directory');
+  const output = resolve(base, path);
+  if (!inside(base, output)) throw new Error(`Path escapes the local data directory: ${path}`);
+  assertNoSymlink(output, base);
+  return output;
+}
+
+export function readBytes(path, { maxBytes = MAX_JSON_BYTES, base = null } = {}) {
+  const target = resolve(path);
+  if (base) {
+    if (!inside(base, target)) throw new Error(`Path escapes the local data directory: ${path}`);
+    assertNoSymlink(target, base);
+  } else if (existsSync(target) && lstatSync(target).isSymbolicLink()) throw new Error(`Symbolic link input is not allowed: ${target}`);
+  const stat = lstatSync(target);
+  if (!stat.isFile()) throw new Error(`Expected a regular file: ${target}`);
+  if (stat.size > maxBytes) throw new Error(`File exceeds ${maxBytes} byte limit: ${target}`);
+  return readFileSync(target);
+}
+
+export function readJSON(path, options = {}) {
+  return JSON.parse(readBytes(path, options).toString('utf8').replace(/^\uFEFF/, ''));
+}
+
+export function atomicWrite(path, bytes, { base, mode = 0o600 } = {}) {
+  const target = resolve(path);
+  if (!base || !inside(base, target)) throw new Error(`Write target escapes the local data directory: ${target}`);
+  assertNoSymlink(target, base);
+  mkdirSync(dirname(target), { recursive: true, mode: 0o700 });
+  assertNoSymlink(dirname(target), base);
+  const temporary = `${target}.${randomUUID()}.tmp`;
+  try {
+    writeFileSync(temporary, bytes, { flag: 'wx', mode });
+    renameSync(temporary, target);
+  } catch (error) {
+    try { if (existsSync(temporary)) unlinkSync(temporary); } catch {}
+    throw error;
+  }
+}
+
+export function atomicWriteJSON(path, value, options) {
+  atomicWrite(path, JSON.stringify(value, null, 2) + '\n', options);
+}

package/plugins/jobhunt-kit/scripts/maintenance.mjs

@@ -0,0 +1,292 @@
+import { randomUUID } from 'node:crypto';
+import { copyFileSync, existsSync, lstatSync, mkdirSync, readdirSync, rmSync } from 'node:fs';
+import { basename, dirname, join, relative, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { DatabaseSync } from 'node:sqlite';
+import { Tracker, initData } from './tracker.mjs';
+import { atomicWrite, atomicWriteJSON, inside, localPath, readBytes, readJSON, sha256 } from './files.mjs';
+import { validateSchema } from './validation.mjs';
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const BACKUP_ITEMS = ['profile.json', 'policy.json', 'profile.md', 'intake.md', 'resumes', 'materials', 'reports'];
+const MAX_BACKUP_MANIFEST_BYTES = 16 * 1024 * 1024;
+
+function requireSafeTree(path) {
+  const stat = lstatSync(path);
+  if (stat.isSymbolicLink()) throw new Error(`Backup refuses symbolic link: ${path}`);
+  if (stat.isDirectory()) for (const entry of readdirSync(path)) requireSafeTree(join(path, entry));
+}
+
+function copyTree(source, destination) {
+  requireSafeTree(source);
+  const stat = lstatSync(source);
+  if (stat.isDirectory()) {
+    mkdirSync(destination, { recursive: true, mode: 0o700 });
+    for (const entry of readdirSync(source)) copyTree(join(source, entry), join(destination, entry));
+  } else copyFileSync(source, destination);
+}
+
+function inventory(root, path = root) {
+  const rows = [];
+  for (const entry of readdirSync(path)) {
+    const full = join(path, entry);
+    const stat = lstatSync(full);
+    if (stat.isSymbolicLink()) throw new Error(`Backup contains symbolic link: ${full}`);
+    if (stat.isDirectory()) rows.push(...inventory(root, full));
+    else rows.push({ path: relative(root, full).replaceAll('\\', '/'), bytes: stat.size, sha256: sha256(readBytes(full, { maxBytes: Number.MAX_SAFE_INTEGER })) });
+  }
+  return rows.sort((a, b) => a.path.localeCompare(b.path));
+}
+
+function quoteSQLite(path) { return `'${String(path).replaceAll("'", "''")}'`; }
+
+function invalidateAuthorization(directory, reason) {
+  const dir = resolve(directory);
+  const store = new Tracker(dir);
+  try {
+    const profilePath = localPath(dir, 'profile.json');
+    const profileBytes = readBytes(profilePath, { base: dir });
+    const profile = JSON.parse(profileBytes.toString('utf8').replace(/^\uFEFF/, ''));
+    if (profile.confirmed_at !== null) {
+      profile.confirmed_at = null;
+      validateSchema('profile', profile);
+      store.writeManagedJSON('profile.json', profile, { expectedSha256: sha256(profileBytes), eventKind: 'authorization_invalidated', eventPayload: { reason } });
+    }
+    const policyPath = localPath(dir, 'policy.json');
+    const policyBytes = readBytes(policyPath, { base: dir });
+    const policy = JSON.parse(policyBytes.toString('utf8').replace(/^\uFEFF/, ''));
+    if (policy.mode !== 'review_each' || policy.auto !== null) {
+      policy.mode = 'review_each';
+      policy.auto = null;
+      validateSchema('policy', policy);
+      store.writeManagedJSON('policy.json', policy, { expectedSha256: sha256(policyBytes), eventKind: 'authorization_invalidated', eventPayload: { reason } });
+    }
+  } finally { store.close(); }
+}
+
+function validateDatabaseSnapshot(root) {
+  validateSchema('profile', readJSON(join(root, 'profile.json')));
+  validateSchema('policy', readJSON(join(root, 'policy.json')));
+  const store = new DatabaseSync(join(root, 'history.sqlite'), { readOnly: true });
+  try {
+    const database = store.prepare('PRAGMA integrity_check').all().map(row => row.integrity_check);
+    const foreignKeys = store.prepare('PRAGMA foreign_key_check').all();
+    if (database.length !== 1 || database[0] !== 'ok' || foreignKeys.length) throw new Error('Backup database failed integrity check');
+    if (store.prepare('PRAGMA user_version').get().user_version !== 2) throw new Error('Backup database schema is not v2');
+    if (store.prepare('SELECT COUNT(*) AS count FROM pending_file_writes').get().count) throw new Error('Backup contains pending managed file writes');
+    for (const name of ['profile.json', 'policy.json']) {
+      const tracked = store.prepare('SELECT sha256 FROM file_revisions WHERE name=?').get(name);
+      const actual = sha256(readBytes(join(root, name), { maxBytes: Number.MAX_SAFE_INTEGER }));
+      if (!tracked || tracked.sha256 !== actual) throw new Error(`Backup ${name} does not match its database revision`);
+    }
+  } finally { store.close(); }
+}
+
+function quarantineData(directory, destination) {
+  const dir = resolve(directory);
+  const target = resolve(destination);
+  if (inside(dir, target) || inside(target, dir)) throw new Error('Quarantine directory must be separate from live data');
+  if (existsSync(target)) throw new Error('Quarantine destination already exists');
+  mkdirSync(target, { recursive: true, mode: 0o700 });
+  for (const name of [...BACKUP_ITEMS, 'history.sqlite', 'history.sqlite-wal', 'history.sqlite-shm']) {
+    const source = localPath(dir, name);
+    if (existsSync(source)) copyTree(source, join(target, name));
+  }
+  const manifest = { schema_version: 'quarantine-1', created_at: new Date().toISOString(), source_name: basename(dir), files: inventory(target) };
+  atomicWriteJSON(join(target, 'quarantine-manifest.json'), manifest, { base: target });
+  return { directory: target, files: manifest.files.length, restorable_only_by_manual_recovery: true };
+}
+
+export function backupData(directory, destination) {
+  const dir = resolve(directory);
+  const target = resolve(destination);
+  if (inside(dir, target) || inside(target, dir)) throw new Error('Backup directory must be separate from the live data directory');
+  if (existsSync(target) && lstatSync(target).isSymbolicLink()) throw new Error('Backup destination cannot be a symbolic link');
+  if (existsSync(target) && readdirSync(target).length) throw new Error('Backup destination must be empty');
+  mkdirSync(target, { recursive: true, mode: 0o700 });
+  const store = new Tracker(dir);
+  try {
+    const check = store.integrity();
+    if (!check.database_ok || check.foreign_key_violations.length || check.pending_file_writes.length ||
+        Object.values(check.files).some(file => !file.valid || !file.tracked_sha256_matches)) {
+      throw new Error('Refusing to back up invalid data; run doctor and repair first');
+    }
+    store.db.exec('PRAGMA wal_checkpoint(FULL)');
+    store.db.exec(`VACUUM INTO ${quoteSQLite(join(target, 'history.sqlite'))}`);
+  } finally { store.close(); }
+  for (const name of BACKUP_ITEMS) {
+    const source = localPath(dir, name);
+    if (existsSync(source)) copyTree(source, join(target, name));
+  }
+  validateDatabaseSnapshot(target);
+  const manifest = { schema_version: 1, created_at: new Date().toISOString(), source_name: basename(dir), files: inventory(target) };
+  const manifestBytes = Buffer.from(JSON.stringify(manifest, null, 2) + '\n');
+  if (manifestBytes.length > MAX_BACKUP_MANIFEST_BYTES) throw new Error(`Backup manifest exceeds the ${MAX_BACKUP_MANIFEST_BYTES} byte limit`);
+  atomicWrite(join(target, 'backup-manifest.json'), manifestBytes, { base: target });
+  verifyBackupContents(target);
+  return { directory: target, files: manifest.files.length, manifest: join(target, 'backup-manifest.json') };
+}
+
+function verifyBackupContents(source) {
+  const root = resolve(source);
+  if (lstatSync(root).isSymbolicLink()) throw new Error('Backup root cannot be a symbolic link');
+  const manifest = readJSON(join(root, 'backup-manifest.json'), { maxBytes: MAX_BACKUP_MANIFEST_BYTES });
+  if (manifest.schema_version !== 1 || !Array.isArray(manifest.files)) throw new Error('Unsupported backup manifest');
+  const expectedPaths = new Set();
+  for (const expected of manifest.files) {
+    if (!expected || typeof expected.path !== 'string' || expectedPaths.has(expected.path)) throw new Error('Backup manifest contains an invalid or duplicate path');
+    expectedPaths.add(expected.path);
+    const path = resolve(root, expected.path);
+    if (!inside(root, path) || !existsSync(path)) throw new Error(`Backup file missing: ${expected.path}`);
+    const bytes = readBytes(path, { maxBytes: Number.MAX_SAFE_INTEGER });
+    if (bytes.length !== expected.bytes || sha256(bytes) !== expected.sha256) throw new Error(`Backup file failed verification: ${expected.path}`);
+  }
+  const actual = inventory(root).filter(row => row.path !== 'backup-manifest.json');
+  if (JSON.stringify(actual) !== JSON.stringify([...manifest.files].sort((a, b) => a.path.localeCompare(b.path)))) {
+    throw new Error('Backup contents do not exactly match the manifest');
+  }
+  validateDatabaseSnapshot(root);
+  return manifest;
+}
+
+export function verifyBackup(source) {
+  const manifest = verifyBackupContents(source);
+  return { valid: true, files: manifest.files.length, created_at: manifest.created_at };
+}
+
+export function restoreData(directory, source, confirmation) {
+  if (confirmation !== 'RESTORE VERIFIED JOBHUNT BACKUP') throw new Error('Exact restore confirmation required');
+  const dir = resolve(directory);
+  const backup = resolve(source);
+  const manifest = verifyBackupContents(backup);
+  const safety = `${dir}.pre-restore-${new Date().toISOString().replace(/[:.]/g, '-')}`;
+  const staging = `${dir}.restore-staging-${randomUUID()}`;
+  mkdirSync(staging, { recursive: true, mode: 0o700 });
+  try {
+    for (const name of [...BACKUP_ITEMS, 'history.sqlite']) {
+      const input = join(backup, name);
+      if (existsSync(input)) copyTree(input, join(staging, name));
+    }
+    if (JSON.stringify(inventory(staging)) !== JSON.stringify([...manifest.files].sort((a, b) => a.path.localeCompare(b.path)))) {
+      throw new Error('Staged restore contents changed after backup verification');
+    }
+    validateDatabaseSnapshot(staging);
+    invalidateAuthorization(staging, 'restore_replaced_local_ledger');
+    validateDatabaseSnapshot(staging);
+    quarantineData(dir, safety);
+    try {
+      mkdirSync(dir, { recursive: true, mode: 0o700 });
+      for (const name of [...BACKUP_ITEMS, 'history.sqlite', 'history.sqlite-wal', 'history.sqlite-shm']) {
+        const target = localPath(dir, name);
+        if (existsSync(target)) rmSync(target, { recursive: true, force: true });
+      }
+      for (const name of [...BACKUP_ITEMS, 'history.sqlite']) {
+        const input = join(staging, name);
+        if (existsSync(input)) copyTree(input, join(dir, name));
+      }
+      const ignore = localPath(dir, '.gitignore');
+      if (!existsSync(ignore)) atomicWrite(ignore, '*\n', { base: dir });
+      validateDatabaseSnapshot(dir);
+    } catch (error) {
+      try {
+        for (const name of [...BACKUP_ITEMS, 'history.sqlite', 'history.sqlite-wal', 'history.sqlite-shm']) {
+          const target = localPath(dir, name);
+          if (existsSync(target)) rmSync(target, { recursive: true, force: true });
+          const input = join(safety, name);
+          if (existsSync(input)) copyTree(input, target);
+        }
+      } catch (rollbackError) {
+        throw new AggregateError([error, rollbackError], `Restore and automatic rollback failed; quarantine preserved at ${safety}`);
+      }
+      throw error;
+    }
+  } finally { if (existsSync(staging)) rmSync(staging, { recursive: true, force: true }); }
+  return { restored: true, source: backup, automatic_quarantine: safety };
+}
+
+export function privacyMap(directory) {
+  const dir = resolve(directory);
+  return {
+    data: dir,
+    authoritative: { candidate_facts: localPath(dir, 'profile.json'), history: localPath(dir, 'history.sqlite'), policy: localPath(dir, 'policy.json') },
+    derived_or_copied: { resumes: localPath(dir, 'resumes'), materials: localPath(dir, 'materials'), reports: localPath(dir, 'reports') },
+    notes: ['profile_saved events in schema v2 store changed field names, not complete profile snapshots', 'older schema v1 events may contain full profile snapshots', 'data is local and not encrypted']
+  };
+}
+
+function setPath(object, dotted, replacement) {
+  const parts = dotted.split('.').filter(Boolean);
+  if (!parts.length) throw new Error('Redaction fields must be dotted profile paths');
+  let current = object;
+  for (const part of parts.slice(0, -1)) {
+    if (!current || typeof current !== 'object' || !(part in current)) throw new Error(`Unknown profile field: ${dotted}`);
+    current = current[part];
+  }
+  const leaf = parts.at(-1);
+  if (!current || typeof current !== 'object' || !(leaf in current)) throw new Error(`Unknown profile field: ${dotted}`);
+  current[leaf] = replacement;
+}
+
+function redactLegacy(value) {
+  if (Array.isArray(value)) return value.map(redactLegacy);
+  if (!value || typeof value !== 'object') return value;
+  const output = {};
+  for (const [key, item] of Object.entries(value)) output[key] = ['previous', 'next', 'user_authorization'].includes(key) ? '[REDACTED]' : redactLegacy(item);
+  return output;
+}
+
+export function redactData(directory, input) {
+  if (input.confirmation !== 'REDACT LOCAL JOBHUNT PII') throw new Error('Exact redaction confirmation required');
+  if (!Array.isArray(input.fields) || !input.fields.length || !input.fields.every(field => typeof field === 'string')) throw new Error('Redaction requires profile fields');
+  const dir = resolve(directory);
+  const store = new Tracker(dir);
+  try {
+    const profilePath = localPath(dir, 'profile.json');
+    const bytes = readBytes(profilePath, { base: dir });
+    const profile = JSON.parse(bytes.toString('utf8'));
+    for (const field of input.fields) setPath(profile, field, null);
+    profile.confirmed_at = null;
+    validateSchema('profile', profile);
+    store.writeManagedJSON('profile.json', profile, { expectedSha256: sha256(bytes), eventKind: 'privacy_redacted', eventPayload: { fields: input.fields } });
+    if (input.redact_legacy_history !== false) {
+      const rows = store.db.prepare('SELECT id,payload FROM events').all();
+      const update = store.db.prepare('UPDATE events SET payload=? WHERE id=?');
+      store.transaction(() => { for (const row of rows) update.run(JSON.stringify(redactLegacy(JSON.parse(row.payload))), row.id); });
+    }
+    return { redacted: input.fields, confirmation_required_for_search: true, legacy_history_redacted: input.redact_legacy_history !== false };
+  } finally { store.close(); }
+}
+
+export function purgeData(directory, input) {
+  if (input.confirmation !== 'PURGE LOCAL JOBHUNT DATA') throw new Error('Exact purge confirmation required');
+  if (typeof input.backup_directory !== 'string' || !input.backup_directory) throw new Error('Purge requires backup_directory');
+  const allowed = ['history', 'materials', 'resumes', 'reports', 'profile'];
+  const requested = input.scopes || allowed;
+  if (!Array.isArray(requested) || !requested.length || requested.some(scope => !allowed.includes(scope))) throw new Error(`Purge scopes: ${allowed.join(', ')}`);
+  const scopes = requested.includes('history') ? [...new Set([...requested, 'reports'])] : requested;
+  const dir = resolve(directory);
+  const backup = backupData(dir, input.backup_directory);
+  if (scopes.includes('history')) invalidateAuthorization(dir, 'history_purged');
+  if (scopes.includes('history')) for (const name of ['history.sqlite', 'history.sqlite-wal', 'history.sqlite-shm']) {
+    const path = localPath(dir, name); if (existsSync(path)) rmSync(path, { force: true });
+  }
+  for (const scope of ['materials', 'resumes', 'reports']) if (scopes.includes(scope)) {
+    const path = localPath(dir, scope); if (existsSync(path)) rmSync(path, { recursive: true, force: true }); mkdirSync(path, { mode: 0o700 });
+  }
+  if (scopes.includes('profile')) {
+    if (scopes.includes('history')) {
+      for (const name of ['profile.json', 'policy.json', 'profile.md', 'intake.md']) atomicWrite(localPath(dir, name), readBytes(join(ROOT, 'templates', name)), { base: dir });
+    } else {
+      const store = new Tracker(dir);
+      try {
+        for (const name of ['profile.json', 'policy.json']) {
+          const current = readBytes(localPath(dir, name), { base: dir });
+          store.writeManagedJSON(name, readJSON(join(ROOT, 'templates', name)), { expectedSha256: sha256(current), eventKind: `${name.split('.')[0]}_purged`, eventPayload: {} });
+        }
+      } finally { store.close(); }
+      for (const name of ['profile.md', 'intake.md']) atomicWrite(localPath(dir, name), readBytes(join(ROOT, 'templates', name)), { base: dir });
+    }
+  }
+  initData(dir);
+  return { purged: scopes, backup };
+}

package/plugins/jobhunt-kit/scripts/profile.mjs

@@ -1,19 +1,16 @@
-import { readFileSync, writeFileSync, existsSync, renameSync } from 'node:fs';
-import { join } from 'node:path';
-import { randomUUID } from 'node:crypto';
+import { existsSync } from 'node:fs';
+import { dirname, join } from 'node:path';
 import { Tracker } from './tracker.mjs';
+import { atomicWriteJSON, readBytes, readJSON as safeReadJSON, sha256 } from './files.mjs';
+import { schemaErrors } from './validation.mjs';
 
-export const readJSON = path => JSON.parse(readFileSync(path, 'utf8').replace(/^\uFEFF/, ''));
-export function writeJSON(path, value) {
-  const temporary = `${path}.${randomUUID()}.tmp`;
-  writeFileSync(temporary, JSON.stringify(value, null, 2) + '\n');
-  renameSync(temporary, path);
-}
+export const readJSON = path => safeReadJSON(path);
+export function writeJSON(path, value, base = dirname(path)) { atomicWriteJSON(path, value, { base }); }
 const filled = value => typeof value === 'string' && value.trim().length > 0;
 export function validateProfile(p) {
-  const errors = [];
+  const errors = schemaErrors('profile', p);
   const warnings = [];
-  if (!p || typeof p !== 'object' || Array.isArray(p)) return { valid: false, errors: ['Profile must be an object'], warnings };
+  if (!p || typeof p !== 'object' || Array.isArray(p)) return { valid: false, errors, warnings };
   if (p.schema_version !== 1) errors.push('schema_version must be 1');
   for (const field of ['identity', 'search', 'resume', 'availability', 'writing']) {
     if (!p[field] || typeof p[field] !== 'object' || Array.isArray(p[field])) errors.push(`${field} must be an object`);
@@ -53,27 +50,33 @@ export function saveProfile(dir, input) {
   if (!check.valid) throw new Error(check.errors.join('; '));
   const file = join(dir, 'profile.json');
   if (!existsSync(file)) throw new Error('Run profile init first');
-  const previous = readJSON(file);
   const next = { ...input, confirmed_at: null };
   const store = new Tracker(dir);
   try {
-    store.event('profile_saved', { previous, next });
-    writeJSON(file, next);
+    const previousBytes = readBytes(file, { base: dir });
+    const previous = JSON.parse(previousBytes.toString('utf8').replace(/^\uFEFF/, ''));
+    const changed_fields = [...new Set([...Object.keys(previous), ...Object.keys(next)])]
+      .filter(key => JSON.stringify(previous[key]) !== JSON.stringify(next[key]));
+    store.writeManagedJSON('profile.json', next, { expectedSha256: sha256(previousBytes), eventKind: 'profile_saved', eventPayload: { changed_fields } });
     return { saved: true, confirmation_required: true, check };
   } finally { store.close(); }
 }
 export function confirmProfile(dir, note) {
   if (!filled(note)) throw new Error('Explicit user confirmation note required');
   const file = join(dir, 'profile.json');
-  const profile = readJSON(file);
-  const check = validateProfile(profile);
-  if (!check.valid) throw new Error(check.errors.join('; '));
-  profile.confirmed_at = new Date().toISOString();
   const store = new Tracker(dir);
   try {
-    writeJSON(file, profile);
+    const profileBytes = readBytes(file, { base: dir });
+    const profile = JSON.parse(profileBytes.toString('utf8').replace(/^\uFEFF/, ''));
+    const check = validateProfile(profile);
+    if (!check.valid) throw new Error(check.errors.join('; '));
+    profile.confirmed_at = new Date().toISOString();
+    const profileHash = serializedHash(profile);
+    store.writeManagedJSON('profile.json', profile, { expectedSha256: sha256(profileBytes), eventKind: 'profile_confirmed',
+      eventPayload: { user_confirmation: note, profile_hash: profileHash } });
     const result = store.profile();
-    store.event('profile_confirmed', { user_confirmation: note, profile_hash: result.hash });
     return { confirmed_at: profile.confirmed_at, hash: result.hash, warnings: check.warnings };
   } finally { store.close(); }
 }
+
+function serializedHash(value) { return sha256(JSON.stringify(value)); }

package/plugins/jobhunt-kit/scripts/resume.mjs

@@ -1,41 +1,42 @@
-import { createHash } from 'node:crypto';
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs';
+import { readFileSync, existsSync, mkdirSync } from 'node:fs';
 import { basename, extname, join, resolve, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { spawnSync } from 'node:child_process';
 import { readJSON, writeJSON } from './profile.mjs';
 import { Tracker } from './tracker.mjs';
+import { atomicWrite, localPath, MAX_RESUME_BYTES, readBytes, sha256 as fingerprint } from './files.mjs';
 
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
-const fingerprint = bytes => createHash('sha256').update(bytes).digest('hex');
 export function importResume(dir, file) {
   const pfile = join(dir, 'profile.json');
-  const profile = readJSON(pfile);
-  const bytes = readFileSync(resolve(file));
-  if (!bytes.length) throw new Error('Resume file is empty');
-  const extension = extname(file).toLowerCase();
-  if (!['.txt', '.md', '.pdf', '.docx', '.doc', '.rtf'].includes(extension)) throw new Error('Supported resume files: txt, md, pdf, docx, doc, rtf');
-  const sha256 = fingerprint(bytes);
-  const filename = `${sha256}${extension}`;
-  const path = join(dir, 'resumes', filename);
-  mkdirSync(dirname(path), { recursive: true });
-  if (!existsSync(path)) writeFileSync(path, bytes, { flag: 'wx' });
-  else if (fingerprint(readFileSync(path)) !== sha256) throw new Error('Stored resume fingerprint mismatch');
-  if (profile.resume?.sha256 !== sha256 || profile.resume?.path !== `resumes/${filename}`) {
-    profile.resume = { path: `resumes/${filename}`, sha256, review_status: 'not_reviewed' };
-    profile.confirmed_at = null;
-    const store = new Tracker(dir);
-    try { store.event('resume_imported', { source_name: basename(file), sha256, bytes: bytes.length }); }
-    finally { store.close(); }
-    writeJSON(pfile, profile);
-  }
-  return { path, sha256, bytes: bytes.length, review_status: profile.resume.review_status, next: 'resume check' };
+  const store = new Tracker(dir);
+  try {
+    const profileBytes = readBytes(pfile, { base: dir });
+    const profile = JSON.parse(profileBytes.toString('utf8').replace(/^\uFEFF/, ''));
+    const bytes = readBytes(resolve(file), { maxBytes: MAX_RESUME_BYTES });
+    if (!bytes.length) throw new Error('Resume file is empty');
+    const extension = extname(file).toLowerCase();
+    if (!['.txt', '.md', '.pdf', '.docx', '.doc', '.rtf'].includes(extension)) throw new Error('Supported resume files: txt, md, pdf, docx, doc, rtf');
+    const sha256 = fingerprint(bytes);
+    const filename = `${sha256}${extension}`;
+    const path = localPath(dir, `resumes/${filename}`);
+    mkdirSync(dirname(path), { recursive: true });
+    if (!existsSync(path)) atomicWrite(path, bytes, { base: dir });
+    else if (fingerprint(readBytes(path, { maxBytes: MAX_RESUME_BYTES, base: dir })) !== sha256) throw new Error('Stored resume fingerprint mismatch');
+    if (profile.resume?.sha256 !== sha256 || profile.resume?.path !== `resumes/${filename}`) {
+      profile.resume = { path: `resumes/${filename}`, sha256, review_status: 'not_reviewed' };
+      profile.confirmed_at = null;
+      store.writeManagedJSON('profile.json', profile, { expectedSha256: fingerprint(profileBytes), eventKind: 'resume_imported',
+        eventPayload: { source_name: basename(file), sha256, bytes: bytes.length } });
+    }
+    return { path, sha256, bytes: bytes.length, review_status: profile.resume.review_status, next: 'resume check' };
+  } finally { store.close(); }
 }
 export function checkResume(dir) {
   const profile = readJSON(join(dir, 'profile.json'));
   if (!profile.resume?.path) throw new Error('Import a resume first: resume <file>');
-  const path = resolve(dir, profile.resume.path);
-  const bytes = readFileSync(path);
+  const path = localPath(dir, profile.resume.path);
+  const bytes = readBytes(path, { maxBytes: MAX_RESUME_BYTES, base: dir });
   const sha256 = fingerprint(bytes);
   const extension = extname(path).toLowerCase();
   const findings = [];
@@ -69,24 +70,27 @@ export function checkResume(dir) {
   const output = join(dir, 'materials', `resume-${sha256}`);
   mkdirSync(output, { recursive: true });
   writeJSON(join(output, 'checks.json'), result);
-  if (text !== null) writeFileSync(join(output, 'text.txt'), text);
+  if (text !== null) atomicWrite(join(output, 'text.txt'), text, { base: dir });
   const review = join(output, 'review.md');
-  if (!existsSync(review)) writeFileSync(review, readFileSync(join(ROOT, 'templates', 'resume-review.md')), { flag: 'wx' });
+  if (!existsSync(review)) atomicWrite(review, readFileSync(join(ROOT, 'templates', 'resume-review.md')), { base: dir });
   return { ...result, checks_path: join(output, 'checks.json'), review_path: review,
     agent_instruction: `Use job-resume. Review ${path}; mechanical checks: ${join(output, 'checks.json')}. Complete ${review}. Do not infer an ATS score from these checks.` };
 }
 export function recordResumeReview(dir, review) {
   const file = join(dir, 'profile.json');
-  const profile = readJSON(file);
-  if (!profile.resume?.path) throw new Error('Import a resume first');
-  const actual = fingerprint(readFileSync(resolve(dir, profile.resume.path)));
-  if (review.sha256 !== actual || profile.resume.sha256 !== actual) throw new Error('Review must refer to the current registered file');
-  if (!['ready', 'needs_changes'].includes(review.status) || typeof review.evidence !== 'string' || !review.evidence.trim()) throw new Error('Review needs status and evidence');
-  if (review.status === 'ready' && !['text', 'visual', 'facts'].every(k => review.checks?.[k] === 'pass')) throw new Error('Ready requires recorded text, visual and factual checks');
   const store = new Tracker(dir);
-  try { store.event('resume_reviewed', review); } finally { store.close(); }
-  profile.resume.review_status = review.status;
-  profile.confirmed_at = null;
-  writeJSON(file, profile);
-  return { recorded: true, confirmation_required: true, status: review.status };
+  try {
+    const profileBytes = readBytes(file, { base: dir });
+    const profile = JSON.parse(profileBytes.toString('utf8').replace(/^\uFEFF/, ''));
+    if (!profile.resume?.path) throw new Error('Import a resume first');
+    const resumePath = localPath(dir, profile.resume.path);
+    const actual = fingerprint(readBytes(resumePath, { maxBytes: MAX_RESUME_BYTES, base: dir }));
+    if (review.sha256 !== actual || profile.resume.sha256 !== actual) throw new Error('Review must refer to the current registered file');
+    if (!['ready', 'needs_changes'].includes(review.status) || typeof review.evidence !== 'string' || !review.evidence.trim()) throw new Error('Review needs status and evidence');
+    if (review.status === 'ready' && !['text', 'visual', 'facts'].every(k => review.checks?.[k] === 'pass')) throw new Error('Ready requires recorded text, visual and factual checks');
+    profile.resume.review_status = review.status;
+    profile.confirmed_at = null;
+    store.writeManagedJSON('profile.json', profile, { expectedSha256: fingerprint(profileBytes), eventKind: 'resume_reviewed', eventPayload: review });
+    return { recorded: true, confirmation_required: true, status: review.status };
+  } finally { store.close(); }
 }

package/plugins/jobhunt-kit/scripts/setup.mjs

@@ -1,25 +1,23 @@
 #!/usr/bin/env node
-import { copyFileSync, mkdirSync } from 'node:fs';
-import { dirname, resolve, join } from 'node:path';
+import { existsSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { spawnSync } from 'node:child_process';
-import { initData } from './tracker.mjs';
 
 try {
   const [flag, data, install] = process.argv.slice(2);
   if (flag !== '--data' || !data || (install && install !== '--install-cli')) throw new Error('Usage: setup.mjs --data <directory> [--install-cli]');
-  const result = initData(data);
+  const root = resolve(dirname(fileURLToPath(import.meta.url)), '..');
   if (install) {
-    const root = resolve(dirname(fileURLToPath(import.meta.url)), '..');
-    const runtime = join(result.data, 'runtime');
-    mkdirSync(runtime, { recursive: true });
-    for (const name of ['package.json', 'package-lock.json']) copyFileSync(join(root, name), join(runtime, name));
-    // Fixed arguments; npm on Windows is a .cmd launcher. User paths go via cwd, not shell text.
-    const options = { cwd: runtime, stdio: 'inherit', windowsHide: true };
+    // Install next to the bundle so ESM resolution is independent of ambient parent node_modules.
+    const options = { cwd: root, stdio: 'inherit', windowsHide: true };
     const r = process.platform === 'win32'
       ? spawnSync('cmd.exe', ['/d', '/s', '/c', 'npm ci --ignore-scripts --no-audit --no-fund'], options)
       : spawnSync('npm', ['ci', '--ignore-scripts', '--no-audit', '--no-fund'], options);
     if (r.error || r.status !== 0) throw new Error(r.error?.message || 'npm ci failed; no sign-in or search was attempted');
+    if (!existsSync(join(root, 'node_modules', 'ajv', 'package.json'))) throw new Error('npm ci completed without installing the local runtime dependencies');
   }
+  const { initData } = await import('./tracker.mjs');
+  const result = initData(data);
   console.log(JSON.stringify({ ...result, cli_install_requested: Boolean(install), authenticated: false }, null, 2));
 } catch (e) { console.error(`jobhunt-kit: ${e.message}`); process.exitCode = 1; }